Knowledge Base

In GitLab CE/EE versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 a high severity vulnerability CVE-2026-15723 was detected. This vulnerability allows an authenticated attacker to completely take over an existing LDAP-backed account without any interaction from the victim. This occurs due to an LDAP Injection flaw (Improper Neutralization of Special Elements) when both OmniAuth SAML and LDAP auto-linking are enabled on the instance. Because the application fails to properly sanitize input within the LDAP email lookup path during OmniAuth identity linking, an attacker can manipulate the LDAP query to illegitimately associate their own identity with the targeted user’s account. To address this issue, users should upgrade GitLab to versions 19.3.6, 19.4.3, 19.5.1, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15723.

In Jenkins versions 2.575 and earlier, and LTS 2.568.1 and earlier a high severity vulnerability CVE-2026-70429 was detected. This vulnerability allows an attacker to impersonate other users or gain unauthorized permissions. This occurs due to the inconsistent handling of case-insensitivity in user names and group names. If an attacker has the ability to create new users or groups, they can craft names that case-insensitively match existing, higher-privileged accounts or groups. Consequently, the system may confuse the newly created entity with the targeted one, leading to identity spoofing and privilege escalation in certain circumstances. To address this issue, users should upgrade Jenkins to a patched version (such as 2.576, LTS 2.568.2, or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-70429.

In Elasticsearch versions from 8.0.0 before 8.19.15, 9.0.0 before 9.2.9, and 9.3.0 before 9.3.4 a medium severity vulnerability CVE-2026-63136 was detected. This vulnerability allows an authenticated user with search privileges to cause a Denial of Service (DoS) condition through heap memory exhaustion. This occurs due to an uncontrolled resource consumption flaw. By submitting a specially crafted search request, an attacker can force a data node to excessively allocate and exhaust all available heap memory. This leads to immediate node unavailability, severe cluster degradation, and potential cluster downtime that requires manual intervention to restore service. To address this issue, users should upgrade Elasticsearch to versions 8.19.15, 9.2.9, 9.3.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-63136.

In Docling versions from 2.82.0 prior to 2.91.0 a high severity vulnerability CVE-2026-44016 was detected. This vulnerability allows an attacker to execute arbitrary JavaScript, perform Server-Side Request Forgery (SSRF) attacks, exfiltrate data, or potentially achieve Remote Code Execution (RCE) within the rendering environment. This occurs when the Playwright-based HTML backend is explicitly configured for rendering (a feature that is deactivated by default). By supplying an untrusted, specially crafted HTML document, an attacker can force the application to execute malicious scripts that make unauthorized network requests to internal services. To address this issue, users should upgrade Docling to version 2.91.0 or later, or ensure the HTML rendering feature remains disabled. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44016.

In Joomla! versions from 4.0.0 before 5.4.8, and 6.0.0 before 6.1.3 a medium severity vulnerability CVE-2026-72532 was detected. This vulnerability allows an unauthorized user to create categories, leading to unwanted structural modifications on the site. This occurs due to improper Access Control List (ACL) checks within the category webservice endpoints. By sending requests directly to these APIs, an attacker can bypass the intended access restrictions and generate new categories without possessing the required permissions. To address this issue, users should upgrade Joomla! to versions 5.4.8, 6.1.3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72532.

In Appsmith versions prior to 2.1 a critical severity vulnerability CVE-2026-55455 was detected. This vulnerability allows an authenticated user to perform Server-Side Request Forgery (SSRF) attacks, enabling them to craft outbound requests that reach loopback-bound services inside the container. This occurs due to a flawed outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins). The filter only validates hosts against an exact-match string denylist, completely bypassing the comprehensive address-class checks (such as loopback, any-local, link-local, and fc00::/7) that are correctly implemented on a separate code path used by SMTP. To address this issue, users should upgrade Appsmith to version 2.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55455.