In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47263 was detected. This vulnerability allows an authenticated user (or an anonymous user if login_required is disabled) to access sensitive webhook payloads, leading to information disclosure. This occurs because the MessageBus.publish call for the /web_hook_events/<id> endpoint within Jobs::RedeliverWebHookEvents fails to pass the group_ids parameter. As a result, the communication channel remains readable by unintended users. Since webhook IDs are sequential integers, an attacker can easily enumerate them to access arbitrary event redelivery payloads. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47263.
In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a high severity vulnerability CVE-2026-7387 was detected. This vulnerability allows an authenticated user with group-link permissions to escalate their own privileges, as well as the privileges of other group members, to team or channel administrator. This occurs because the application fails to enforce proper role-management authorization checks when setting the scheme_admin flag on group syncable link and patch endpoints. An attacker can exploit this flaw by submitting crafted API requests. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, and 10.11.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7387.
In Ansible Lightspeed all the versions a medium severity vulnerability CVE-2026-44188 was detected. This vulnerability allows a remote attacker to hijack a session and gain unauthorized read access to sensitive Ansible resources, such as inventories, playbooks, and configuration data. This occurs due to insufficient session expiration logic. If an attacker exfiltrates a valid OAuth access token before a user logs out, they can maintain persistent access because the backend application fails to properly invalidate the token upon logout, leaving it active until its natural expiration. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44188.
Read more IT Business Management
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53440 was detected. This vulnerability allows an attacker to perform phishing attacks by redirecting users to a malicious, attacker-controlled domain (Open Redirect). This occurs because the “Delegate to servlet container” security realm fails to properly validate the from parameter to ensure it is safe to redirect to after a successful login. To address this issue, users should upgrade Jenkins to a patched version 2.568 or LTS 2.555.3 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53440.
In GitLab CE/EE versions 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a medium severity vulnerability CVE-2026-10733 was detected. This vulnerability allows an authenticated user to cause a Denial of Service (DoS) condition. This occurs due to improper sanitization of user input on the CI/CD Catalog page. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10733.
Read more Developer Tools
In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a medium severity vulnerability CVE-2026-6689 was detected. This vulnerability allows an authenticated user with team creation permissions to bypass intended access controls and configure invite-related settings. This occurs due to a missing PermissionInviteUser check when setting AllowOpenInvite or AllowedDomains during the initial team creation process via the POST /api/v4/teams endpoint. While the system properly enforces this check when updating an existing team, this flaw allows a user to create a team that is publicly joinable or restricted to specific domains without having the actual permission to invite users. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, 10.11.17, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6689.