In HAProxy versions through 3.4.0 a high severity vulnerability CVE-2026-55203 was detected. This vulnerability allows a malicious FastCGI backend to desynchronize the FCGI framing parser, potentially leading to request routing errors, response smuggling, or memory safety issues. This occurs due to an integer overflow in the fcgi_conn structure’s drl field. Specifically, when contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and a buffer misparse. To address this issue, users should upgrade HAProxy to a patched version 3.4.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55203.
In NocoDB versions prior to 2026.05.1 a medium severity vulnerability CVE-2026-53928 was detected. This vulnerability allows an attacker in possession of a stolen refresh token to maintain unauthorized access by minting new JSON Web Tokens (JWTs), even after the victim has completed a password recovery flow. This occurs because the passwordForgot process fails to delete the user’s active refresh tokens—unlike standard password change or reset flows—leaving them valid for exchange. To address this issue, users should upgrade NocoDB to version 2026.05.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53928.
In GitLab EE versions 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 a low severity vulnerability CVE-2026-3176 was detected. This vulnerability allows an authenticated user with limited permissions to gain unauthorized access to project information. This occurs due to missing or insufficient authorization checks under certain conditions. To address this issue, users should upgrade GitLab EE to versions 18.11.6, 19.0.3, or 19.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3176.
Read more Developer Tools
In vLLM versions 0.10.2 to before 0.13.0 a high severity vulnerability CVE-2026-56340 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) through crashes or resource exhaustion, with the potential for out-of-bounds memory corruption. This occurs because the multimodal embeddings processing lacks proper sparse tensor validation. When the prompt-embeds feature is enabled, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices. Because PyTorch disables sparse tensor invariant checks by default, these malicious tensors bypass validation. This flaw is a continuation of CVE-2025-62164, where the initial fix only disabled the feature by default instead of addressing the root cause. To address this issue, users should upgrade vLLM to version 0.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56340.
In Traefik versions 3.7.0-ea.1 to before 3.7.5 a medium severity vulnerability CVE-2026-54762 was detected. This vulnerability allows an unauthenticated attacker to access backend services that were intended to be protected, leading to an authentication bypass. This occurs in the Kubernetes Ingress NGINX provider due to a fail-open behavior. When an Ingress explicitly enables BasicAuth or DigestAuth through annotations, but the referenced auth-secret cannot be resolved or parsed (e.g., it is missing, malformed, or policy-denied), Traefik logs the error and skips installing the authentication middleware, while still routing traffic to the backend service. To address this issue, users should upgrade Traefik to version 3.7.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-54762.
In Gogs versions prior to 0.14.3 a medium severity vulnerability CVE-2026-52815 was detected. This vulnerability allows an unauthenticated attacker to view sensitive organizational data, resulting in information disclosure. This occurs because the GET /api/v1/orgs/:orgname/teams endpoint lacks the necessary reqToken() middleware and performs no authentication checks within the listTeams() handler. As a result, anyone can retrieve team IDs, names, descriptions, and permission levels for any organization. To address this issue, users should upgrade Gogs to version 0.14.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-52815.
In MongoDB Server versions 8.3.0 through 8.3.3, 8.2.0 through 8.2.10, 8.0.0 through 8.0.25, 7.0.0 through 7.0.36, 6.0.0 through 6.0.28, 5.0.0 through 5.0.33, 4.4.0 through 4.4.30 a high severity vulnerability CVE-2026-11933 was detected. This vulnerability allows an authenticated user with read privileges to cause a Denial of Service (DoS) or disclose sensitive information from the mongod process memory. This occurs due to a Use-After-Free (UAF) flaw in the server-side JavaScript engine when converting BSON documents to JavaScript arrays. By executing server-side JavaScript (for example, via the $where or $function operators), an attacker can trigger the server to access memory that has already been freed. To address this issue, users should upgrade MongoDB Server to a patched version 8.3.x, 8.2.11, or 8.0.26 (or later), 7.0.37 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11933.
In RustDesk Client versions up to, including, 1.4.5 on Windows, MacOS, Linux, iOS, Android, and WebClient a high severity vulnerability CVE-2026-30792 was detected. This vulnerability allows an attacker to bypass local security settings and manipulate Application API messages via a Man-in-the-Middle (MitM) attack. This occurs because the client blindly merges unauthenticated strategy payloads received during synchronization. Specifically, the strategy merge loop (in src/hbbs_http/sync.Rs) and the Config::set_options() engine fail to properly authenticate or validate incoming configuration payloads before applying them. To address this issue, users should upgrade RustDesk Client to a patched version 1.4.6 or newer. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30792.
In MariaDB Server versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 a medium severity vulnerability CVE-2026-44169 was detected. This vulnerability allows an authenticated user to gain unauthorized visibility into stored routine definitions, leading to information disclosure. This occurs because if a user is granted EXECUTE access to a stored routine via a role, the system improperly permits them to see the routine’s definition, even if they lack the explicitly required SHOW CREATE ROUTINE privilege. To address this issue, users should upgrade MariaDB Server to versions 11.4.11, 11.8.7, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44169.