Our news and updates

In Gogs versions prior to 0.14.2 a medium severity vulnerability CVE-2026-26195 was detected. This vulnerability allows attackers to perform Stored Cross-Site Scripting (XSS) through author and committer names in branch and wiki views due to unsafe template rendering combined with permissive sanitizer handling of data URLs. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26195.

In Gogs versions prior to 0.14.2 a high severity vulnerability CVE-2026-26194 was detected. This vulnerability allows attackers to inject arbitrary Git options when deleting a release if a user-controlled tag name is passed without proper sanitization, potentially manipulating the release deletion process. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26194.

In Gogs versions prior to 0.14.2 a high severity vulnerability CVE-2026-26022 was detected. This vulnerability allows authenticated attackers to inject and execute arbitrary JavaScript via data URI schemes in issue comments or descriptions, due to insufficient sanitization. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26022.

In Gogs versions prior to 0.14.2 a critical severity vulnerability CVE-2026-25921 was detected. This vulnerability allows attackers to maliciously overwrite Git LFS objects across different repositories due to missing content hash verification, potentially enabling supply-chain attacks. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25921.

In FreeScout versions prior to 1.8.206 a critical severity vulnerability CVE-2026-27636 was detected. This vulnerability allows authenticated users to upload `.htaccess` files on Apache servers with `AllowOverride All`, bypassing file upload restrictions and enabling remote code execution. To address this issue, users should upgrade FreeScout to version 1.8.206 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27636.

In Gogs versions prior to 0.14.2 a high severity vulnerability CVE-2026-26276 was detected. This vulnerability allows attackers to store malicious HTML or JavaScript payloads in a repository’s Milestone name, which can trigger a DOM-based Cross-Site Scripting (XSS) attack when another user selects that milestone on the New Issue page. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26276.

In Dolibarr ERP/CRM version 10.0.1 a high severity vulnerability CVE-2019-25450 was detected. This vulnerability allows authenticated attackers to execute arbitrary SQL queries via POST parameters such as `actioncode`, `demand_reason_id`, and `availability_id` in the `card.php` endpoint, potentially exposing sensitive database information through boolean-based blind, error-based, or time-based blind SQL injection techniques. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2019-25450.

In Foreman versions 1.22.0 and higher a high severity vulnerability CVE-2025-9572 was detected. This vulnerability allows low-privileged users to bypass access controls in the GraphQL API, enabling them to access metadata beyond their assigned permissions and potentially leading to unauthorized information disclosure. To address this issue, users should upgrade Foreman to versions 3.16.2 or 3.17.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9572.

In FreeScout versions prior to 1.8.206 a critical severity vulnerability CVE-2026-27637 was detected. This vulnerability allows attackers to compute predictable authentication tokens using `MD5(user_id + created_at + APP_KEY)`, enabling full account takeover, including administrative accounts, without requiring a password. To address this issue, users should upgrade FreeScout to version 1.8.206 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27637.