Knowledge Base

In NocoDB versions prior to 2026.05.1 a medium severity vulnerability CVE-2026-53928 was detected. This vulnerability allows an attacker in possession of a stolen refresh token to maintain unauthorized access by minting new JSON Web Tokens (JWTs), even after the victim has completed a password recovery flow. This occurs because the passwordForgot process fails to delete the user’s active refresh tokens—unlike standard password change or reset flows—leaving them valid for exchange. To address this issue, users should upgrade NocoDB to version 2026.05.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53928.

In GitLab EE versions 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 a low severity vulnerability CVE-2026-3176 was detected. This vulnerability allows an authenticated user with limited permissions to gain unauthorized access to project information. This occurs due to missing or insufficient authorization checks under certain conditions. To address this issue, users should upgrade GitLab EE to versions 18.11.6, 19.0.3, or 19.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3176.

In Gogs versions prior to 0.14.3 a medium severity vulnerability CVE-2026-52815 was detected. This vulnerability allows an unauthenticated attacker to view sensitive organizational data, resulting in information disclosure. This occurs because the GET /api/v1/orgs/:orgname/teams endpoint lacks the necessary reqToken() middleware and performs no authentication checks within the listTeams() handler. As a result, anyone can retrieve team IDs, names, descriptions, and permission levels for any organization. To address this issue, users should upgrade Gogs to version 0.14.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-52815.

In Traefik versions 3.7.0-ea.1 to before 3.7.5 a medium severity vulnerability CVE-2026-54762 was detected. This vulnerability allows an unauthenticated attacker to access backend services that were intended to be protected, leading to an authentication bypass. This occurs in the Kubernetes Ingress NGINX provider due to a fail-open behavior. When an Ingress explicitly enables BasicAuth or DigestAuth through annotations, but the referenced auth-secret cannot be resolved or parsed (e.g., it is missing, malformed, or policy-denied), Traefik logs the error and skips installing the authentication middleware, while still routing traffic to the backend service. To address this issue, users should upgrade Traefik to version 3.7.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-54762.

In vLLM versions 0.10.2 to before 0.13.0 a high severity vulnerability CVE-2026-56340 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) through crashes or resource exhaustion, with the potential for out-of-bounds memory corruption. This occurs because the multimodal embeddings processing lacks proper sparse tensor validation. When the prompt-embeds feature is enabled, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices. Because PyTorch disables sparse tensor invariant checks by default, these malicious tensors bypass validation. This flaw is a continuation of CVE-2025-62164, where the initial fix only disabled the feature by default instead of addressing the root cause. To address this issue, users should upgrade vLLM to version 0.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56340.

In NocoDB versions prior to 2026.05.1 a medium severity vulnerability CVE-2026-53930 was detected. This vulnerability allows an attacker to perform Server-Side Request Forgery (SSRF), probe internal HTTP destinations, and abuse URI schemes (such as file: or ftp:). This occurs because the base-migration endpoint accepts a caller-supplied URL that the migration worker dereferences without enforcing proper protocol or destination restrictions. To address this issue, users should upgrade NocoDB to version 2026.05.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53930.