Knowledge Base

In RustDesk Client versions up to, including, 1.4.5 on Windows, MacOS, Linux, iOS, Android, and WebClient a high severity vulnerability CVE-2026-30792 was detected. This vulnerability allows an attacker to bypass local security settings and manipulate Application API messages via a Man-in-the-Middle (MitM) attack. This occurs because the client blindly merges unauthenticated strategy payloads received during synchronization. Specifically, the strategy merge loop (in src/hbbs_http/sync.Rs) and the Config::set_options() engine fail to properly authenticate or validate incoming configuration payloads before applying them. To address this issue, users should upgrade RustDesk Client to a patched version 1.4.6 or newer. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30792.

In OpenVPN versions 2.6.0 to 2.6.6 a critical severity vulnerability CVE-2023-46850 was detected. This vulnerability allows a remote attacker to cause undefined behavior, leak memory buffers, or potentially achieve Remote Code Execution (RCE). This occurs due to a Use-After-Free (UAF) flaw that is triggered when sending network buffers to a remote peer. To address this issue, users should upgrade OpenVPN to a patched version 2.6.8 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-46850.

In MongoDB Server versions 8.3.0 through 8.3.3, 8.2.0 through 8.2.10, 8.0.0 through 8.0.25, 7.0.0 through 7.0.36, 6.0.0 through 6.0.28, 5.0.0 through 5.0.33, 4.4.0 through 4.4.30 a high severity vulnerability CVE-2026-11933 was detected. This vulnerability allows an authenticated user with read privileges to cause a Denial of Service (DoS) or disclose sensitive information from the mongod process memory. This occurs due to a Use-After-Free (UAF) flaw in the server-side JavaScript engine when converting BSON documents to JavaScript arrays. By executing server-side JavaScript (for example, via the $where or $function operators), an attacker can trigger the server to access memory that has already been freed. To address this issue, users should upgrade MongoDB Server to a patched version 8.3.x, 8.2.11, or 8.0.26 (or later), 7.0.37 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11933.

In MariaDB Server versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 a medium severity vulnerability CVE-2026-44169 was detected. This vulnerability allows an authenticated user to gain unauthorized visibility into stored routine definitions, leading to information disclosure. This occurs because if a user is granted EXECUTE access to a stored routine via a role, the system improperly permits them to see the routine’s definition, even if they lack the explicitly required SHOW CREATE ROUTINE privilege. To address this issue, users should upgrade MariaDB Server to versions 11.4.11, 11.8.7, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44169.

In NocoDB versions prior to 2026.05.1 a medium severity vulnerability CVE-2026-53930 was detected. This vulnerability allows an attacker to perform Server-Side Request Forgery (SSRF), probe internal HTTP destinations, and abuse URI schemes (such as file: or ftp:). This occurs because the base-migration endpoint accepts a caller-supplied URL that the migration worker dereferences without enforcing proper protocol or destination restrictions. To address this issue, users should upgrade NocoDB to version 2026.05.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53930.

In RustDesk Client versions up to, including 1.4.5 on Windows, MacOS, Linux, iOS, and Android a high severity vulnerability CVE-2026-30794 was detected. This vulnerability allows an attacker to perform Adversary in the Middle (AiTM) attacks and intercept sensitive communications. This occurs due to improper certificate validation in the HTTP API client; specifically, if an initial TLS handshake fails, the client attempts a retry using the danger_accept_invalid_certs(true) configuration in the TLS transport module, which silently accepts invalid TLS certificates. To address this issue, users should upgrade RustDesk Client to a patched version 1.4.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30794.