In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a medium severity vulnerability CVE-2026-6689 was detected. This vulnerability allows an authenticated user with team creation permissions to bypass intended access controls and configure invite-related settings. This occurs due to a missing PermissionInviteUser check when setting AllowOpenInvite or AllowedDomains during the initial team creation process via the POST /api/v4/teams endpoint. While the system properly enforces this check when updating an existing team, this flaw allows a user to create a team that is publicly joinable or restricted to specific domains without having the actual permission to invite users. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, 10.11.17, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6689.
In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-44783 was detected. This vulnerability allows authenticated users outside of the allowed groups to post unauthorized messages into a topic’s staff-only whisper channel. This occurs due to a flaw in how replies to whisper posts are handled on sites where the whispers feature is enabled. As a result, the injected content becomes visible to authorized whisperers (typically staff members) alongside legitimate whispers. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44783.
Read more Communication
In LiteLLM versions 1.74.2 to before 1.83.7 a medium severity vulnerability CVE-2026-42271 was detected. This vulnerability allows any authenticated user, including those with low-privileged internal-user keys, to execute arbitrary commands on the proxy host. This occurs because the MCP server preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) improperly accept and execute a full server configuration from the request body. When a stdio configuration containing command, args, and env fields is supplied, the endpoints spawn the specified command as a subprocess with the privileges of the proxy process, completely bypassing role-based access checks. To address this issue, users should upgrade LiteLLM to version 1.83.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42271.
In GitLab CE/EE versions 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a low severity vulnerability CVE-2026-3553 was detected. This vulnerability allows an authenticated user to access confidential issue details under certain conditions, leading to sensitive information disclosure. This occurs due to incorrect authorization checks within the application’s issue tracking system. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3553.
Read more Developer Tools
In Jenkins versions 2.483 through 2.567 (inclusive), and LTS 2.492.1 through 2.555.2 (inclusive) a high severity vulnerability CVE-2026-53441 was detected. This vulnerability allows an authenticated attacker with Agent/Configure permission to execute malicious JavaScript in the context of another user’s browser, leading to a Stored Cross-Site Scripting (XSS) attack. This occurs because Jenkins fails to properly escape the user-provided description of a generic offline cause when set through the POST config.xml API. If a malicious description is provided, the injected payload will be executed when an administrator or another user views the affected node. To address this issue, users should upgrade Jenkins to a patched version to 2.568. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53441.
In OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 a medium severity vulnerability CVE-2026-40215 was detected. This vulnerability allows remote attackers to potentially cause a server crash (Denial of Service) or leak sensitive heap memory. This occurs due to a race condition triggered during TLS session promotion, which leads to a use-after-free vulnerability. To address this issue, users should upgrade OpenVPN to a patched version 2.6.20 or 2.7.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-40215.
Read more CMS
In LiteLLM versions prior to 1.83.10 a high severity vulnerability CVE-2026-47102 was detected. This vulnerability allows an authenticated user, such as one with the org_admin role, to escalate their privileges and gain full administrative access to the platform. This occurs because the /user/update endpoint, while correctly restricting users to updating only their own account, fails to restrict which specific fields can be modified. As a result, an attacker can change their own user_role to proxy_admin, granting them unauthorized control over all users, teams, keys, models, and prompt history. To address this issue, users should upgrade LiteLLM to version 1.83.10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47102.
In Plane versions prior to 1.3.1 a high severity vulnerability CVE-2026-46558 was detected. This vulnerability allows any authenticated attacker to bypass authorization controls, leading to unauthorized data access and modification. This occurs due to a cross-workspace asset authorization bypass flaw, which enables users to read, copy, delete, and overwrite assets belonging to other Plane workspaces. To address this issue, users should upgrade Plane to version 1.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-46558.
Read more Developer Tools
In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11440 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.defaultBranch argument within the REST API endpoint /repositories/{projectId}/default-branch. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11440.