Our news and updates

In Twenty CRM versions 1.7.7 through 1.16.7 a critical severity vulnerability CVE-2026-46624 was detected. This vulnerability allows an authenticated user to execute arbitrary OS commands on the database server (Remote Code Execution) if the Postgres user is a superuser. This occurs due to a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack, where the timeZone field within the group_by query parameter in the REST API is directly interpolated into a raw SQL expression without any parameterization, validation, or escaping. There’s no fix available for this issue at the moment.. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-46624.

In pgAdmin 4 versions prior to 9.15. a high severity vulnerability CVE-2026-7815 was detected. This vulnerability allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL on the connected PostgreSQL server, which can be escalated to operating-system command execution on the database host. This occurs because four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) are concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command without proper sanitization and passed to psql. To address this issue, users should upgrade pgAdmin 4 to version 9.15 or above. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7815.

In NGINX Plus and NGINX Open Source versions 0.6.27 through 0.9.7 and 1.0.0 through 1.30.0. a high severity vulnerability CVE-2026-42945 was detected. This vulnerability allows an unauthenticated attacker to cause a worker process restart (Denial of Service) and potentially execute arbitrary code if Address Space Layout Randomization (ASLR) is disabled or bypassed. This occurs due to a heap buffer overflow in the ngx_http_rewrite_module when a rewrite directive is followed by a rewrite, if, or set directive, and uses an unnamed PCRE capture (e.g., $1, $2) with a replacement string containing a question mark (?). To address this issue, users should upgrade NGINX to version 1.30.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42945.

In vLLM version 0.19.0 a medium severity vulnerability CVE-2026-9540 was detected. This vulnerability allows a remote attacker to cause a Denial of Service (DoS). This occurs due to a flaw in the OpenAI-compatible Serving Path component when processing certain manipulated data. An exploit for this issue is publicly available. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9540.

In Wazuh authd versions prior to 4.14.4 a low severity vulnerability CVE-2026-32984 was detected. This vulnerability allows an attacker to cause a denial of service (DoS) condition. This occurs due to a heap buffer overflow when the authentication daemon processes specially crafted input, leading to memory corruption and malformed heap data. To address this issue, users should upgrade Wazuh to version 4.14.3 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32984.

In Prometheus versions 2.49.0 to before 3.5.3 and 3.11.3 a low severity vulnerability CVE-2026-44903 was detected. This vulnerability allows an attacker who can inject crafted metrics to execute arbitrary JavaScript (XSS) in the browser of any user viewing the metric. This occurs in the legacy web UI (enabled via the –enable-feature=old-ui flag) because the histogram heatmap chart view fails to properly escape ‘le’ label values when inserting them into the HTML for use as axis tick mark labels. To address this issue, users should upgrade Prometheus to versions 3.5.3 or 3.11.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44903.

In MinIO versions RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z a medium severity vulnerability CVE-2026-42600 was detected. This vulnerability allows an attacker holding the cluster root JWT to read arbitrary files from outside the configured drive roots via a path traversal attack. This occurs because the ReadMultiple internode storage-REST endpoint improperly processes a msgpack-encoded POST request containing “../” sequences in the Bucket field, causing the server to open and return the contents of unintended files (bounded only by the MinIO process UID). To address this issue, users should upgrade MinIO to version RELEASE.2026-04-14T21-32-45Z. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42600.

In Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 a medium severity vulnerability CVE-2026-3636 was detected. This vulnerability allows a user without elevated permissions to obtain sensitive data regarding team members’ roles. This occurs because the application fails to properly sanitize team member data when it is returned via various team API endpoints. To address this issue, users should upgrade Mattermost to version Version 11.7.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3636.

In JupyterLab versions 4.0.0 through 4.5.6 a high severity vulnerability CVE-2026-42266 was detected. This vulnerability allows an attacker to install malicious third-party extensions via a POST request. This occurs because the allow-list for the PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced, allowing packages outside the default PyPI index to be installed. To address this issue, users should upgrade JupyterLab to version 4.5.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42266.