Knowledge Base

In OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 a medium severity vulnerability CVE-2026-40215 was detected. This vulnerability allows remote attackers to potentially cause a server crash (Denial of Service) or leak sensitive heap memory. This occurs due to a race condition triggered during TLS session promotion, which leads to a use-after-free vulnerability. To address this issue, users should upgrade OpenVPN to a patched version 2.6.20 or 2.7.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-40215.

In LiteLLM versions prior to 1.83.10 a high severity vulnerability CVE-2026-47102 was detected. This vulnerability allows an authenticated user, such as one with the org_admin role, to escalate their privileges and gain full administrative access to the platform. This occurs because the /user/update endpoint, while correctly restricting users to updating only their own account, fails to restrict which specific fields can be modified. As a result, an attacker can change their own user_role to proxy_admin, granting them unauthorized control over all users, teams, keys, models, and prompt history. To address this issue, users should upgrade LiteLLM to version 1.83.10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47102.

In GitLab CE/EE versions 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a low severity vulnerability CVE-2026-3553 was detected. This vulnerability allows an authenticated user to access confidential issue details under certain conditions, leading to sensitive information disclosure. This occurs due to incorrect authorization checks within the application’s issue tracking system. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3553.

In Jenkins versions 2.483 through 2.567 (inclusive), and LTS 2.492.1 through 2.555.2 (inclusive) a high severity vulnerability CVE-2026-53441 was detected. This vulnerability allows an authenticated attacker with Agent/Configure permission to execute malicious JavaScript in the context of another user’s browser, leading to a Stored Cross-Site Scripting (XSS) attack. This occurs because Jenkins fails to properly escape the user-provided description of a generic offline cause when set through the POST config.xml API. If a malicious description is provided, the injected payload will be executed when an administrator or another user views the affected node. To address this issue, users should upgrade Jenkins to a patched version to 2.568. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53441.

In Plane versions prior to 1.3.1 a high severity vulnerability CVE-2026-46558 was detected. This vulnerability allows any authenticated attacker to bypass authorization controls, leading to unauthorized data access and modification. This occurs due to a cross-workspace asset authorization bypass flaw, which enables users to read, copy, delete, and overwrite assets belonging to other Plane workspaces. To address this issue, users should upgrade Plane to version 1.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-46558.

In RabbitMQ versions 3.7.0 to before 4.1.2 and 4.0.13 a medium severity vulnerability CVE-2026-44839 was detected. This vulnerability allows an attacker to execute malicious JavaScript in the context of a user’s browser, leading to a Stored Cross-Site Scripting (XSS) attack. This occurs because the RabbitMQ management UI fails to properly sanitize virtual host (vhost) names before rendering them. If an attacker has the permissions to create or modify a vhost, they can inject a malicious payload that will be executed when an administrator or another user accesses the management UI. To address this issue, users should upgrade RabbitMQ to versions 4.1.2 or 4.0.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44839.