In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53436 was detected. This vulnerability allows an attacker to perform phishing attacks by tricking users into being redirected to a malicious, attacker-controlled site (Open Redirect). This occurs because the application improperly determines that a redirect URL after login is legitimately pointing back to Jenkins when the URL contains relative path segments (such as ./ or ../). To address this issue, users should upgrade Jenkins to a patched version 2.568 and LTS 2.555.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53436.
In GitLab CE/EE versions 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a low severity vulnerability CVE-2026-9694 was detected. This vulnerability allows an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content. This occurs due to improper neutralization in email template processing when handling a specially crafted Service Desk email reply. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://avd.aquasec.com/nvd/2026/cve-2026-9694.
Read more Developer Tools
In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-45085 was detected. This vulnerability encompasses four distinct misauthorization and information disclosure issues within the chat plugin, with one also involving the discourse-calendar plugin. The flaws allow read-only category users to create chat threads and permit authors to restore self-deleted messages even after their channel access has been revoked. Furthermore, it causes information disclosure by exposing a channel’s last_message (which can include unrelated direct message content) to moderators reviewing flagged messages, and by leaking chat channel details via calendar event payloads to unauthorized viewers, including anonymous users. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45085.
In MariaDB Server versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1 a high severity vulnerability CVE-2026-48163 was detected. This vulnerability allows a malicious joiner node to execute arbitrary shell commands on the donor node. This occurs due to improper validation of parameters sent by the joiner during a State Snapshot Transfer (SST) via the rsync method, which the donor node unsafely interpolates into the command line. To address this issue, users should upgrade MariaDB Server to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48163.
Read more Database
In ChromaDB Python versions 0.5.0 or later a high severity vulnerability CVE-2026-45831 was detected. This vulnerability allows an authenticated user to perform cross-tenant actions and gain unauthorized access to isolated data. This occurs because the SimpleRBACAuthorizationProvider evaluates whether a user holds a given permission, but fails to check which tenant, database, or collection that permission actually applies to. Consequently, attackers can bypass intended access restrictions across different tenant environments. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45831.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53438 was detected. This vulnerability allows an attacker to cancel queue items they do not have permission to view. This occurs due to a missing permission check: users possessing the Item/Cancel permission, but lacking the Item/Read permission, are not properly restricted during the queue item cancellation process. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53438.