Our news and updates

In Django versions 6.0 before 6.0.6 and 5.2 before 5.2.15 a low severity vulnerability CVE-2026-7666 was detected. This vulnerability allows an on-path network attacker to intercept and read email content in cleartext. This occurs because the django.core.mail.backends.smtp.EmailBackend fails to prevent the reuse of a partially-initialized connection after a failed STARTTLS handshake when the fail_silently parameter is set to True. To address this issue, users should upgrade Django to versions 6.0.6 or 5.2.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7666.

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a medium severity vulnerability CVE-2026-32244 was detected. This vulnerability allows anonymous and unprivileged users to view removed content, leading to information disclosure. This occurs because the platform caches outdated AI-generated summaries which are not adequately purged when the original content is deleted. Consequently, users who lack the permissions to regenerate summaries can still access the leaked information through the stale cache. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. As a temporary workaround, administrators can restrict summary generation by tightening the allowed groups on the summarization Personas. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32244.

In MLflow versions up to 3.10.1.dev0 a critical severity vulnerability CVE-2026-2651 was detected. This vulnerability allows an attacker to overwrite artifacts belonging to other users, potentially leading to model supply chain poisoning and arbitrary code execution when compromised models are loaded. This occurs because the authorization logic fails to enforce resource-level permission checks for multipart upload (MPU) endpoints (/mlflow-artifacts/mpu/*) when the –serve-artifacts mode is enabled, enabling unauthorized cross-user writes. To address this issue, users should upgrade MLflow to version 3.10.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2651.

In Zabbix versions prior to 6.0.41, 7.0.18, and 7.4.2 a high severity vulnerability CVE-2026-23925 was detected. This vulnerability allows an authenticated low-privileged user to create unauthorized hosts, potentially leading to a loss of confidentiality. This occurs because a user with the basic “User” role and template/host write permissions can bypass standard role restrictions by utilizing the configuration.import API to create objects, an action that should normally be restricted for this role. To address this issue, users should upgrade Zabbix to version 7.4.2 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23925.

In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11438 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.forkedFromId argument within the /projects functionality. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11438.

In authentik versions prior to 2025.12.6, 2026.2.4, and 2026.5.1 a high severity vulnerability CVE-2026-49443 was detected. This vulnerability allows an attacker to log into any user’s account (Account Takeover). This occurs because an attacker who has the ability to change a source connection and possesses an account in one of the configured sources can exploit improper validation of the source connection to bypass authentication. To address this issue, users should upgrade authentik to versions 2025.12.6, 2026.2.4, or 2026.5.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-4944.

In Appsmith versions versions prior to 2.1 a medium severity vulnerability CVE-2026-7299 was detected. This vulnerability allows an authenticated user with Developer privileges to inject a persistent Cross-Site Scripting (XSS) payload, leading to arbitrary code execution in the sessions of other workspace members. This occurs because the SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML. An attacker can exploit this by creating malicious table or column names, which then trigger the payload when other users interact with the same datasource. To address this issue, users should upgrade Appsmith to version 2.1 and later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7299.

In Portainer Community Edition versions 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0 a high severity vulnerability CVE-2026-44848 was detected. This vulnerability allows a standard non-admin user with endpoint access to potentially achieve Remote Code Execution (RCE) on the host system. This occurs because the Docker plugin management endpoints (/plugins/*) lack proper authorization handler registration. As a result, standard users can bypass Resource Control access restrictions and directly call privileged operations, such as installing and enabling plugins, against the underlying Docker daemon. To address this issue, users should upgrade Portainer Community Edition to versions 2.33.8, 2.39.2, or 2.41.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44848.

In MLflow versions prior to 3.11.0 a critical severity vulnerability CVE-2026-4035 was detected. This vulnerability allows an attacker to exfiltrate sensitive server-side environment credentials, such as AWS access keys, to an attacker-controlled endpoint. This occurs because the api_key field in AI Gateway secrets incorrectly resolves environment variable references (e.g., $ENV_VAR) against the MLflow server’s environment during runtime. The resolved secrets are then sent in provider authentication headers to a configured upstream api_base. This can be exploited by unauthenticated users in default deployments or low-privileged users in basic-auth deployments, potentially leading to artifact poisoning and cross-boundary code execution. To address this issue, users should upgrade MLflow to version 3.11.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-4035.