In ChromaDB Python versions from including0.5.0 up to, including, 1.5.9 a high severity vulnerability CVE-2026-45832 was detected. This vulnerability allows an attacker to bypass authorization controls and gain unauthorized access to data. This occurs because all V1 collection-level endpoints improperly pass None for the tenant and database parameters to the authorization layer. By interacting directly with these V1 endpoints, attackers can successfully circumvent intended access restrictions. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45832.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53438 was detected. This vulnerability allows an attacker to cancel queue items they do not have permission to view. This occurs due to a missing permission check: users possessing the Item/Cancel permission, but lacking the Item/Read permission, are not properly restricted during the queue item cancellation process. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53438.
In MongoDB versions from including 7.0.0 and before 7.0.35, including 8.0.0 and before 8.0.24, including 8.2.0 and before 8.2.10, including 8.3.0 and before 8.3.3 a medium severity vulnerability CVE-2026-9750 was detected. This vulnerability allows an authenticated user to cause a server crash (Denial of Service) or return incorrect query results. This occurs due to insufficient separation between user-controlled document fields and internal metadata during query execution. By creating specifically crafted documents, an attacker can interfere with internal metadata processing. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9750.
Read more Database
In MariaDB Server versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1 a high severity vulnerability CVE-2026-48165 was detected. This vulnerability allows a high-privileged MariaDB user to execute arbitrary shell commands with the privileges of the mariadbd process on the galera joiner node. This occurs due to improper handling of the wsrep_sst_receive_address or wsrep_sst_donor global system variables. To address this issue, users should upgrade MariaDB Server to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48165.
In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47264 was detected. This vulnerability allows an unprivileged or anonymous user to view the names of restricted tag groups, leading to information disclosure. This occurs because the DetailedTagSerializer#tag_group_names function returns every tag group a tag belongs to without properly filtering against the requesting user’s visibility permissions. When the SiteSetting.tags_listed_by_group setting is enabled, hitting the TagsController#info endpoint (which is exempt from login requirements) exposes the names of tag groups that should be restricted to specific user groups or non-visible categories. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47264.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53440 was detected. This vulnerability allows an attacker to perform phishing attacks by redirecting users to a malicious, attacker-controlled domain (Open Redirect). This occurs because the “Delegate to servlet container” security realm fails to properly validate the from parameter to ensure it is safe to redirect to after a successful login. To address this issue, users should upgrade Jenkins to a patched version 2.568 or LTS 2.555.3 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53440.