In MariaDB Server versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1 a high severity vulnerability CVE-2026-48165 was detected. This vulnerability allows a high-privileged MariaDB user to execute arbitrary shell commands with the privileges of the mariadbd process on the galera joiner node. This occurs due to improper handling of the wsrep_sst_receive_address or wsrep_sst_donor global system variables. To address this issue, users should upgrade MariaDB Server to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48165.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53438 was detected. This vulnerability allows an attacker to cancel queue items they do not have permission to view. This occurs due to a missing permission check: users possessing the Item/Cancel permission, but lacking the Item/Read permission, are not properly restricted during the queue item cancellation process. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53438.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53440 was detected. This vulnerability allows an attacker to perform phishing attacks by redirecting users to a malicious, attacker-controlled domain (Open Redirect). This occurs because the “Delegate to servlet container” security realm fails to properly validate the from parameter to ensure it is safe to redirect to after a successful login. To address this issue, users should upgrade Jenkins to a patched version 2.568 or LTS 2.555.3 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53440.
In GitLab CE/EE versions 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a medium severity vulnerability CVE-2026-10733 was detected. This vulnerability allows an authenticated user to cause a Denial of Service (DoS) condition. This occurs due to improper sanitization of user input on the CI/CD Catalog page. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10733.
Read more Developer Tools
In Ansible Lightspeed all the versions a medium severity vulnerability CVE-2026-44188 was detected. This vulnerability allows a remote attacker to hijack a session and gain unauthorized read access to sensitive Ansible resources, such as inventories, playbooks, and configuration data. This occurs due to insufficient session expiration logic. If an attacker exfiltrates a valid OAuth access token before a user logs out, they can maintain persistent access because the backend application fails to properly invalidate the token upon logout, leaving it active until its natural expiration. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44188.
Read more IT Business Management
In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47263 was detected. This vulnerability allows an authenticated user (or an anonymous user if login_required is disabled) to access sensitive webhook payloads, leading to information disclosure. This occurs because the MessageBus.publish call for the /web_hook_events/<id> endpoint within Jobs::RedeliverWebHookEvents fails to pass the group_ids parameter. As a result, the communication channel remains readable by unintended users. Since webhook IDs are sequential integers, an attacker can easily enumerate them to access arbitrary event redelivery payloads. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47263.
In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a high severity vulnerability CVE-2026-7387 was detected. This vulnerability allows an authenticated user with group-link permissions to escalate their own privileges, as well as the privileges of other group members, to team or channel administrator. This occurs because the application fails to enforce proper role-management authorization checks when setting the scheme_admin flag on group syncable link and patch endpoints. An attacker can exploit this flaw by submitting crafted API requests. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, and 10.11.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7387.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53442 was detected. This vulnerability allows an attacker with Item/Extended Read permission, or access to the Jenkins controller file system, to access sensitive information. This occurs because Jenkins fails to encrypt secrets submitted via the POST config.xml API before storing them. As a result, these secrets are saved in plaintext within the job’s config.xml files on the Jenkins controller. To address this issue, users should upgrade Jenkins to a patched version 2.568.0 or later, or LTS 2.555.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53442.
In GitLab EE versions 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a high severity vulnerability CVE-2026-10087 was detected. This vulnerability allows an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user, effectively leading to a Cross-Site Scripting (XSS) attack. This occurs due to improper input sanitization within the Analytics Dashboard. To address this issue, users should upgrade GitLab EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10087.
Read more Developer Tools