Our news and updates

In Budibase versions 3.24.0 and earlier a high severity vulnerability CVE-2026-25737 was detected. This vulnerability allows an attacker to bypass file extension restrictions enforced at the UI level and upload arbitrary malicious files to the server. Exploiting this vulnerability can lead to code execution or compromise of the platform. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25737.

In Budibase versions 3.32.3 and prior a high severity vulnerability CVE-2026-25045 was detected. This vulnerability allows a Creator-level user to bypass server-side RBAC checks in the `/api/global/users` endpoints, enabling actions such as promoting App Viewers to Tenant Admins, demoting Tenant Admins, or modifying the Owner’s account details and orders. Exploiting this vulnerability can lead to full tenant compromise. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25045.

In Budibase versions 3.23.22 and earlier a high severity vulnerability CVE-2026-25041 was detected. This vulnerability allows attackers to execute arbitrary shell commands because the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25041.

In Kimai versions prior to 2.51.0 a medium severity vulnerability CVE-2026-28685 was detected. This vulnerability allows attackers with ROLE_TEAMLEAD to access invoices belonging to customers they should not have permission to view due to missing customer-level access control in the API. To address this issue, users should upgrade Kimai to version 2.51.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28685.

In Mattermost Desktop App versions up to and including 5.13.3 a medium severity vulnerability CVE-2026-1628 was detected. This vulnerability allows a malicious server to expose preload script functionality to untrusted servers when a user opens an external link within the Mattermost app, due to missing listeners restricting navigation to external sites. To address this issue, users should upgrade Mattermost Desktop App to version 5.13.4.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1628.

In @backstage/plugin-techdocs-node versions prior to 1.14.3 a high severity vulnerability CVE-2026-29186 was detected. This vulnerability allows attackers to execute arbitrary Python code by crafting a malicious mkdocs.yml file that bypasses the plugin’s allowlist for dangerous configuration keys during the TechDocs build process. To address this issue, users should upgrade @backstage/plugin-techdocs-node to version 1.14.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29186.

In @backstage/integration versions prior to 1.20.1 a low severity vulnerability CVE-2026-29185 was detected. This vulnerability allows attackers to include encoded path traversal sequences in SCM URLs, potentially causing integration functions to redirect requests to unintended SCM provider API endpoints using server-side integration credentials. To address this issue, users should upgrade @backstage/integration to version 1.20.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29185.

In @backstage/plugin-scaffolder-backend versions prior to 3.1.4 a low severity vulnerability CVE-2026-29184 was detected. This vulnerability allows a malicious scaffolder template to bypass the log redaction mechanism and exfiltrate secrets provided during task execution through event logs. To address this issue, users should upgrade @backstage/plugin-scaffolder-backend to version 3.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29184.

In Gogs versions prior to 0.14.2 a medium severity vulnerability CVE-2026-26196 was detected. This vulnerability allows attackers to obtain access tokens because the API accepts tokens in URL parameters such as `token` and `access_token`, which can be exposed through logs, browser history, or referrers. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26196.