Our news and updates

In Kanboard versions prior to 1.2.51 a high severity vulnerability CVE-2026-29056 was detected. This vulnerability allows an attacker who receives a user invite link to inject `role=app-admin` during registration, creating an administrator account and escalating privileges. To address this issue, users should upgrade Kanboard to version 1.2.51. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29056.

In Kibana all versions from 8.0.0 up to and including 8.19.12, all versions from 9.0.0 up to and including 9.2.6, all versions from 9.3.0 up to and including 9.3.1 a medium severity vulnerability CVE-2026-26940 was detected. This vulnerability allows an authenticated user to send a specially crafted Timelion expression with an excessively large quantity value, causing internal series data properties to be overwritten and resulting in a Denial of Service via excessive resource allocation. To address this issue, users should upgrade Kibana to versions 8.19.13, 9.2.7 or 9.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26940.

In Kibana all versions from 8.0.0 up to and including 8.19.11, all versions from 9.0.0 up to and including 9.2.5, and version 9.3.0 a high severity vulnerability CVE-2026-26939 was detected. This vulnerability allows an authenticated attacker with rule management privileges to bypass server-side authorization in the Detection Rule Management system, enabling unauthorized configuration of endpoint response actions such as host isolation, process termination, and process suspension. To address this issue, users should upgrade Kibana to versions 8.19.12, 9.2.6 or 9.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26939.

In Mattermost Plugins versions 2.0.3.0 and earlier a medium severity vulnerability CVE-2026-2476 was detected. This vulnerability allows an attacker with access to support packets to obtain original plugin settings because sensitive configuration values are not properly masked in exported configuration data. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2476.

In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27454 was detected. This vulnerability allows attackers to bypass authorization checks and access hidden post revisions by requesting specific version parameters in the /posts/:id.json endpoint. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27454.

In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27166 was detected. This vulnerability allows attackers to perform HTML injection by exploiting insufficient sanitization of the default Codepen allowed iframes, potentially tricking users into changing the main page URL. To address this issue, users should upgrade to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27166.

In Jenkins versions 2.442 through 2.554 and LTS versions 2.426.3 through 2.541.2 a high severity vulnerability CVE-2026-33002 was detected. This vulnerability allows attackers to bypass origin validation on the CLI WebSocket endpoint by exploiting DNS rebinding, due to origin checks relying on the Host or X-Forwarded-Host HTTP headers. To address this issue, users should upgrade Jenkins to versions beyond 2.554 or beyond LTS 2.541.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33002.

In Jenkins versions 2.554 and earlier, and LTS versions 2.541.2 and earlier a high severity vulnerability CVE-2026-33001 was detected. This vulnerability allows attackers with Item/Configure permissions to write arbitrary files on the filesystem by exploiting unsafe symbolic link handling during the extraction of .tar and .tar.gz archives. To address this issue, users should upgrade Jenkins to versions beyond 2.555 or beyond LTS 2.541.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33001.

In Kanboard versions prior to 1.2.51 a high severity vulnerability CVE-2026-33058 was detected. This vulnerability allows attackers with permission to add users to a project to perform SQL injection and dump the entire Kanboard database. To address this issue, users should upgrade Kanboard to version 1.2.51. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33058.