In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47264 was detected. This vulnerability allows an unprivileged or anonymous user to view the names of restricted tag groups, leading to information disclosure. This occurs because the DetailedTagSerializer#tag_group_names function returns every tag group a tag belongs to without properly filtering against the requesting user’s visibility permissions. When the SiteSetting.tags_listed_by_group setting is enabled, hitting the TagsController#info endpoint (which is exempt from login requirements) exposes the names of tag groups that should be restricted to specific user groups or non-visible categories. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47264.
In ChromaDB Python versions from including0.5.0 up to, including, 1.5.9 a high severity vulnerability CVE-2026-45832 was detected. This vulnerability allows an attacker to bypass authorization controls and gain unauthorized access to data. This occurs because all V1 collection-level endpoints improperly pass None for the tenant and database parameters to the authorization layer. By interacting directly with these V1 endpoints, attackers can successfully circumvent intended access restrictions. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45832.
In MongoDB versions from including 7.0.0 and before 7.0.35, including 8.0.0 and before 8.0.24, including 8.2.0 and before 8.2.10, including 8.3.0 and before 8.3.3 a medium severity vulnerability CVE-2026-9750 was detected. This vulnerability allows an authenticated user to cause a server crash (Denial of Service) or return incorrect query results. This occurs due to insufficient separation between user-controlled document fields and internal metadata during query execution. By creating specifically crafted documents, an attacker can interfere with internal metadata processing. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9750.
Read more Database
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53438 was detected. This vulnerability allows an attacker to cancel queue items they do not have permission to view. This occurs due to a missing permission check: users possessing the Item/Cancel permission, but lacking the Item/Read permission, are not properly restricted during the queue item cancellation process. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53438.
In MariaDB Server versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1 a high severity vulnerability CVE-2026-48165 was detected. This vulnerability allows a high-privileged MariaDB user to execute arbitrary shell commands with the privileges of the mariadbd process on the galera joiner node. This occurs due to improper handling of the wsrep_sst_receive_address or wsrep_sst_donor global system variables. To address this issue, users should upgrade MariaDB Server to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48165.
In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47263 was detected. This vulnerability allows an authenticated user (or an anonymous user if login_required is disabled) to access sensitive webhook payloads, leading to information disclosure. This occurs because the MessageBus.publish call for the /web_hook_events/<id> endpoint within Jobs::RedeliverWebHookEvents fails to pass the group_ids parameter. As a result, the communication channel remains readable by unintended users. Since webhook IDs are sequential integers, an attacker can easily enumerate them to access arbitrary event redelivery payloads. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47263.