Our news and updates

In Mattermost Server versions 10.11.x before 10.11.13, 11.3.x before 11.3.3, 11.4.x before 11.4.3, and 11.5.0 high severity vulnerability CVE-2026-28741 was detected. This vulnerability allows attackers to update a user’s authentication method via a CSRF attack by tricking a user into visiting a malicious page. To address this issue users must upgrade to 10.11.13, 11.3.3, 11.4.3, or 11.5.1 versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28741.

In Grafana versions 8.0.1 through 12.3.0 a high severity vulnerability CVE-2025-12141 was detected. This vulnerability allows attackers with Editor permissions to edit contact points created by other users and modify endpoint URLs to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services like Slack tokens. To address this issue users must upgrade to version 12.3.1 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12141.

In HAProxy versions 2.6 through 3.3.5 a medium severity vulnerability CVE-2026-33555 was detected. This vulnerability allows attackers to cause desynchronization issues with the backend server by exploiting a flaw in the HTTP/3 parser, which fails to verify that the received body length matches the announced Content-Length when a stream is closed via an empty payload frame. This can be exploited for request smuggling, potentially leading to unauthorized access or cache poisoning. To address this issue users must upgrade to version 3.3.6 or other patched stable releases (2.6.25, 3.0.19, 3.2.15). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33555.

In Apache Kafka versions 4.1.0 and 4.1.1 a critical severity vulnerability CVE-2026-33557 was detected. This vulnerability allows attackers to bypass authentication and impersonate any user by providing an unvalidated JWT token, as the default validator fails to check signatures, issuers, or audiences. To address this issue users must upgrade to version 4.1.2, 4.2.0, or later, or explicitly set the validator class to BrokerJwtValidator. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33557.

In Apache Kafka versions up to 3.9.1 and 4.0.0 a medium severity vulnerability CVE-2026-33558 was detected. This vulnerability allows attackers to access sensitive information, including authentication credentials and delegation tokens, because the NetworkClient component outputs entire requests and responses—such as SaslAuthenticate and AlterConfigs—when the DEBUG log level is enabled. To address this issue users must upgrade to version 3.9.2, 4.0.1, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33558.

In Kimai versions 2.52.0 and below a high severity vulnerability CVE-2026-40486 was detected. This vulnerability allows attackers with standard user accounts to modify restricted attributes such as hourly_rate and internal_rate via the User Preferences API, bypassing intended permission checks. This unauthorized financial tampering directly impacts invoice generation and timesheet calculations. To address this issue users must upgrade to version 2.53.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-40486.

In Mattermost versions 10.11.x through 10.11.12 a medium severity vulnerability CVE-2026-27769 was detected. This vulnerability allows a malicious remote server connected via the Connected Workspaces feature to change the displayed status of local users by exploiting a failure to validate user ownership within the Connected Workspaces API. To address this issue, users must upgrade to version 11.5.0 or 10.11.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27769.

In Apache Airflow versions 3.0.0 before 3.2.0 low severity vulnerability CVE-2026-32228 was detected. This vulnerability allows attackers with asset materialization permissions to trigger DAGs they otherwise had no access to via the UI or API. To address this issue users must upgrade to 3.2.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32228.

In Apache Airflow versions 3.0.0 before 3.2.0 high severity vulnerability CVE-2026-31987 was detected. This vulnerability allows attackers with UI access to view JWT tokens exposed in task logs, potentially enabling them to impersonate DAG authors and perform unauthorized actions. To address this issue users must upgrade to 3.2.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31987.