Our news and updates

In Gitea versions before 1.25.4 a critical severity vulnerability CVE-2026-20750 was detected. This vulnerability allows an authenticated user with project write access in one organization to modify projects belonging to a different organization, leading to unauthorized data modification and an authorization bypass. This occurs due to an Insecure Direct Object Reference (IDOR) flaw in organization project operations, where Gitea does not properly validate project ownership against the user’s permissions when a Project ID is supplied. To address this issue, users should upgrade Gitea to a patched version [укажите исправленную версию]. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-20750.

In Docling versions 2.73.0 to before 2.91.0 a medium severity vulnerability CVE-2026-44022 was detected. This vulnerability allows an attacker to read arbitrary files from the local file system, potentially exposing configuration files, credentials, and other sensitive data. This occurs due to a path traversal flaw in the LaTeX backend’s handling of the \includegraphics, \input, and \include commands, which lacked proper path containment validation. By crafting a malicious LaTeX document with directory traversal sequences, an attacker can force the system to include sensitive files directly into the converted document output. To address this issue, users should upgrade Docling to version 2.91.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44022.

In Budibase versions prior to 3.39.9 a critical severity vulnerability CVE-2026-54352 was detected. This vulnerability allows an authenticated workspace-level builder to read arbitrary files from the server, leading to sensitive information disclosure. This occurs due to improper handling of symbolic links when processing uploaded PWA ZIP files at the POST /api/pwa/process-zip endpoint. The application uses [email protected], which preserves absolute symlink targets, and the subsequent path validation fails to reject symlink entries before streaming their contents into MinIO. As a result, an attacker can craft a ZIP archive containing symlinks pointing to local system files, which are then processed and served back to the attacker via the asset-fetch endpoint. To address this issue, users should upgrade Budibase to version 3.39.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-54352.

In GeoServer DB2 DataStore Extension versions prior to 2.27.0 a high severity vulnerability CVE-2025-27511 was detected. This vulnerability allows an authenticated administrator to achieve Remote Code Execution (RCE) on the server. This occurs because the extension is vulnerable to a JNDI injection attack when processing a specially crafted DB2 JDBC URL. To address this issue, users should upgrade the GeoServer DB2 DataStore Extension to version 2.27.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27511.

In GitLab EE versions 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 a medium severity vulnerability CVE-2026-5309 was detected. This vulnerability allows an authenticated user to read or modify another group’s virtual registry cleanup policy settings without proper authorization. This occurs due to an authorization bypass flaw involving a user-controlled key under certain conditions. To address this issue, users should upgrade GitLab EE to versions 18.11.6, 19.0.3, or 19.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-5309.

In Gogs versions prior to 0.14.3 a medium severity vulnerability CVE-2026-52816 was detected. This vulnerability allows an unauthenticated attacker to inject malicious HTML or JavaScript, leading to Cross-Site Scripting (XSS). This occurs because the Jupyter Notebook (ipynb) sanitizer endpoint (POST /-/api/sanitize_ipynb) fails to properly restrict data: URIs. It uses a permissive policy (bluemonday.UGCPolicy() with p.AllowURLSchemes("data")) that allows all data URI schemes, including data:text/html. Additionally, the endpoint lacks authentication middleware, allowing any user to exploit it. To address this issue, users should upgrade Gogs to version 0.14.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-52816.

In Moodle versions before 3.5.11, 3.6.9, 3.7.5, and 3.8.2 a medium severity vulnerability CVE-2020-1754 was detected. This vulnerability allows an authenticated user to view the grades of users outside their own groups, leading to unauthorized information disclosure. This occurs because the grade history report fails to properly enforce group restrictions for users who lack the ‘access all groups’ capability. To address this issue, users should upgrade Moodle to versions 3.5.11, 3.6.9, 3.7.5, or 3.8.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-1754.

In HAProxy versions through 3.4.0 a high severity vulnerability CVE-2026-55203 was detected. This vulnerability allows a malicious FastCGI backend to desynchronize the FCGI framing parser, potentially leading to request routing errors, response smuggling, or memory safety issues. This occurs due to an integer overflow in the fcgi_conn structure’s drl field. Specifically, when contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and a buffer misparse. To address this issue, users should upgrade HAProxy to a patched version 3.4.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55203.

In NocoDB versions prior to 2026.05.1 a medium severity vulnerability CVE-2026-53928 was detected. This vulnerability allows an attacker in possession of a stolen refresh token to maintain unauthorized access by minting new JSON Web Tokens (JWTs), even after the victim has completed a password recovery flow. This occurs because the passwordForgot process fails to delete the user’s active refresh tokens—unlike standard password change or reset flows—leaving them valid for exchange. To address this issue, users should upgrade NocoDB to version 2026.05.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53928.