Knowledge Base

In HAProxy versions through 3.4.0 a high severity vulnerability CVE-2026-55203 was detected. This vulnerability allows a malicious FastCGI backend to desynchronize the FCGI framing parser, potentially leading to request routing errors, response smuggling, or memory safety issues. This occurs due to an integer overflow in the fcgi_conn structure’s drl field. Specifically, when contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and a buffer misparse. To address this issue, users should upgrade HAProxy to a patched version 3.4.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55203.

In Moodle versions before 3.5.11, 3.6.9, 3.7.5, and 3.8.2 a medium severity vulnerability CVE-2020-1754 was detected. This vulnerability allows an authenticated user to view the grades of users outside their own groups, leading to unauthorized information disclosure. This occurs because the grade history report fails to properly enforce group restrictions for users who lack the ‘access all groups’ capability. To address this issue, users should upgrade Moodle to versions 3.5.11, 3.6.9, 3.7.5, or 3.8.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-1754.

In GitLab EE versions 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 a medium severity vulnerability CVE-2026-5309 was detected. This vulnerability allows an authenticated user to read or modify another group’s virtual registry cleanup policy settings without proper authorization. This occurs due to an authorization bypass flaw involving a user-controlled key under certain conditions. To address this issue, users should upgrade GitLab EE to versions 18.11.6, 19.0.3, or 19.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-5309.

In GeoServer DB2 DataStore Extension versions prior to 2.27.0 a high severity vulnerability CVE-2025-27511 was detected. This vulnerability allows an authenticated administrator to achieve Remote Code Execution (RCE) on the server. This occurs because the extension is vulnerable to a JNDI injection attack when processing a specially crafted DB2 JDBC URL. To address this issue, users should upgrade the GeoServer DB2 DataStore Extension to version 2.27.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27511.

In Gogs versions prior to 0.14.3 a medium severity vulnerability CVE-2026-52816 was detected. This vulnerability allows an unauthenticated attacker to inject malicious HTML or JavaScript, leading to Cross-Site Scripting (XSS). This occurs because the Jupyter Notebook (ipynb) sanitizer endpoint (POST /-/api/sanitize_ipynb) fails to properly restrict data: URIs. It uses a permissive policy (bluemonday.UGCPolicy() with p.AllowURLSchemes("data")) that allows all data URI schemes, including data:text/html. Additionally, the endpoint lacks authentication middleware, allowing any user to exploit it. To address this issue, users should upgrade Gogs to version 0.14.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-52816.

In Traefik versions 3.7.0-ea.1 to before 3.7.5 a medium severity vulnerability CVE-2026-54762 was detected. This vulnerability allows an unauthenticated attacker to access backend services that were intended to be protected, leading to an authentication bypass. This occurs in the Kubernetes Ingress NGINX provider due to a fail-open behavior. When an Ingress explicitly enables BasicAuth or DigestAuth through annotations, but the referenced auth-secret cannot be resolved or parsed (e.g., it is missing, malformed, or policy-denied), Traefik logs the error and skips installing the authentication middleware, while still routing traffic to the backend service. To address this issue, users should upgrade Traefik to version 3.7.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-54762.