Our news and updates

In Mattermost versions 10.11.x up to and including 10.11.8 and prior to 11.2.0 a low severity vulnerability CVE-2025-14822 was detected. This vulnerability allows authenticated attackers to trigger a denial of service by exhausting CPU resources through a single HTTP request containing a post with thousands of space-separated tokens, exploiting quadratic complexity in the model.ParseHashtags function. To address this issue, users should upgrade Mattermost to versions 10.11.9 or 11.2.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14822.

In Mattermost versions 10.11.x up to and including 10.11.8, 11.0.x up to and including 11.0.6, and 11.1.x up to and including 11.1.1 a medium severity vulnerability CVE-2025-14435 was detected. This vulnerability allows authenticated attackers to cause an application-level denial of service by triggering API errors that lead to unbounded component re-render loops, resulting in infinite re-renders and degraded application availability. To address this issue, users should upgrade Mattermost to versions 10.11.9, 11.1.2 or 11.0.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14435.

In ZITADEL versions prior to 4.9.1 and 3.4.6 a medium severity vulnerability CVE-2026-23511 was detected. This vulnerability allows unauthenticated attackers to enumerate valid user accounts by probing the login interfaces and observing differences when iterating through usernames or user IDs. To address this issue, users should upgrade to ZITADEL versions 4.9.1 or 3.4.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23511.

In OpenProject versions prior to 16.6.2 a medium severity vulnerability CVE-2026-22603 was detected. This vulnerability allows attackers to perform unlimited password-guessing attacks against user accounts by abusing an unauthenticated password-change endpoint that lacks brute-force protection, potentially leading to full account compromise and further privilege escalation. To address this issue, users should upgrade OpenProject to version 16.6.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22603.

In OpenProject versions from 11.2.1 to before 16.6.2 a medium severity vulnerability CVE-2026-22604 was detected. This vulnerability allows attackers to enumerate valid usernames by sending unauthenticated POST requests to the /account/change_password endpoint with arbitrary user IDs, which causes the application to disclose usernames in error responses. To address this issue, users should upgrade OpenProject to version 16.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22604.

In OpenProject versions prior to 16.6.3 a medium severity vulnerability CVE-2026-22605 was detected. This vulnerability allows users with the View Meetings permission on any project to access meeting details belonging to projects they do not have permission to view. To address this issue, users should upgrade OpenProject to version 16.6.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22605.

In OpenProject versions prior to 16.6.2 a medium severity vulnerability CVE-2026-22603 was detected. This vulnerability allows attackers to perform unlimited password-guessing attacks against user accounts by abusing an unauthenticated password-change endpoint that lacks brute-force protection, potentially leading to full account compromise and further privilege escalation. To address this issue, users should upgrade OpenProject to version 16.6.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22603.

In Ghost versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3 a medium severity vulnerability CVE-2026-22596 was detected. This vulnerability allows attackers with valid Ghost Admin API authentication credentials to execute arbitrary SQL commands via the /ghost/api/admin/members/events endpoint, potentially leading to data disclosure, modification, or full database compromise. To address this issue, users should upgrade Ghost to versions 5.130.6 or 6.11.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22596.

In GitLab CE/EE versions from 15.10 before 18.3.6, 18.4 before 18.4.4 and 18.5 before 18.5.2 a high severity vulnerability CVE-2025-11224 was detected. This vulnerability allows an authenticated attacker to perform stored cross-site scripting attacks due to improper input validation in the Kubernetes proxy functionality, potentially executing malicious scripts in the context of other users’ browsers. To address this issue, users should upgrade GitLab to versions 18.3.6, 18.4.4, 18.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11224.