Knowledge Base

In GitLab CE/EE versions 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a low severity vulnerability CVE-2026-9694 was detected. This vulnerability allows an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content. This occurs due to improper neutralization in email template processing when handling a specially crafted Service Desk email reply. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://avd.aquasec.com/nvd/2026/cve-2026-9694.

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-45085 was detected. This vulnerability encompasses four distinct misauthorization and information disclosure issues within the chat plugin, with one also involving the discourse-calendar plugin. The flaws allow read-only category users to create chat threads and permit authors to restore self-deleted messages even after their channel access has been revoked. Furthermore, it causes information disclosure by exposing a channel’s last_message (which can include unrelated direct message content) to moderators reviewing flagged messages, and by leaking chat channel details via calendar event payloads to unauthorized viewers, including anonymous users. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45085.

In MariaDB Server versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1 a high severity vulnerability CVE-2026-48163 was detected. This vulnerability allows a malicious joiner node to execute arbitrary shell commands on the donor node. This occurs due to improper validation of parameters sent by the joiner during a State Snapshot Transfer (SST) via the rsync method, which the donor node unsafely interpolates into the command line. To address this issue, users should upgrade MariaDB Server to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48163.

In ChromaDB Python versions 0.5.0 or later a high severity vulnerability CVE-2026-45831 was detected. This vulnerability allows an authenticated user to perform cross-tenant actions and gain unauthorized access to isolated data. This occurs because the SimpleRBACAuthorizationProvider evaluates whether a user holds a given permission, but fails to check which tenant, database, or collection that permission actually applies to. Consequently, attackers can bypass intended access restrictions across different tenant environments. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45831.

In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53436 was detected. This vulnerability allows an attacker to perform phishing attacks by tricking users into being redirected to a malicious, attacker-controlled site (Open Redirect). This occurs because the application improperly determines that a redirect URL after login is legitimately pointing back to Jenkins when the URL contains relative path segments (such as ./ or ../). To address this issue, users should upgrade Jenkins to a patched version 2.568 and LTS 2.555.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53436.

In MongoDB versions from including 7.0.0 and before 7.0.35, including 8.0.0 and before 8.0.24, including 8.2.0 and before 8.2.10, including 8.3.0 and before 8.3.3 a medium severity vulnerability CVE-2026-9750 was detected. This vulnerability allows an authenticated user to cause a server crash (Denial of Service) or return incorrect query results. This occurs due to insufficient separation between user-controlled document fields and internal metadata during query execution. By creating specifically crafted documents, an attacker can interfere with internal metadata processing. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9750.