Knowledge Base

In Docling versions prior to 2.94.0 a high severity vulnerability CVE-2026-47214 was detected. This vulnerability may allow an attacker to access unauthorized local files, bypass access restrictions, or potentially perform Server-Side Request Forgery (SSRF) attacks. This occurs due to unsafe URI and path handling within the HTML backend. By supplying a specially crafted URI or file path, an attacker can manipulate the application’s resource resolution mechanisms, forcing the backend to access or process unintended and potentially malicious resources. To address this issue, users should upgrade Docling to version 2.94.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47214.

In affected versions of Gitea a high severity vulnerability CVE-2026-107618 was detected. This vulnerability allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack, resulting in the unauthorized modification of a repository’s topics. This occurs because the POST /{owner}/{repo}/topics endpoint was registered without the necessary sign-in middleware that enforces cross-origin protection. Consequently, if an authenticated repository administrator is tricked into visiting a malicious third-party webpage, the site can forge and send a valid request to alter the repository’s topics without the user’s consent. Note that no other repository settings are reachable or modifiable through this specific route. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-107618.

In Jenkins versions 2.587 and earlier, and LTS 2.580.1 and earlier a low severity vulnerability CVE-2026-117624 was detected. This vulnerability allows an attacker to bypass root element checks and potentially inject unauthorized nested objects. This occurs due to inconsistent enforcement of deserialization restrictions. Specifically, Jenkins fails to correctly restrict the deserialization of object types that are marked as storing their configuration in independent top-level configuration files when they are processed as nested values. By submitting a specially crafted payload, an attacker can evade the intended root element validation and inject malicious nested objects into the system. To address this issue, users should upgrade Jenkins to a patched version (such as 2.588, LTS 2.580.2, or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-117624.

In GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 a critical severity vulnerability CVE-2026-97229 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the GitLab server, potentially leading to a complete system compromise. This occurs due to an integer overflow or wraparound flaw caused by insufficient regular expression validation. By supplying a specially crafted regular expression within a CI/CD configuration, an attacker can trigger this vulnerability and execute unauthorized commands on the underlying server. To address this issue, users should upgrade GitLab CE/EE to versions 19.2.8, 19.3.5, 19.4.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-97229.

In Grafana versions from 11.6.0 before 11.6.15, 12.2.0 before 12.2.9, 12.3.0 before 12.3.7, 12.4.0 before 12.4.4, and 13.0.0 before 13.0.2 a high severity vulnerability CVE-2026-33382 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition by exhausting system memory. This occurs because several Grafana API endpoints—including some that are unauthenticated—do not properly limit the size of the request body before processing it. By sending excessively large payloads, an attacker can force the application into excessive memory allocation, which may exhaust available memory and render the service unresponsive or cause it to crash. To address this issue, users should upgrade Grafana to versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, 13.0.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33382.

In Foreman and Red Hat Satellite versions from 6.0 up to and including 6.19 a medium severity vulnerability CVE-2026-13316 was detected. This vulnerability allows an attacker to perform a Server-Side Request Forgery (SSRF) attack and extract sensitive information from cloud metadata services in AWS, GCP, and Azure environments. This occurs due to unvalidated test_url parameters within the Foreman configuration, specifically when HTTP parameters are manipulated in the http_proxies_controller and http_proxy files. By exploiting this flaw, an attacker can force the server to make unauthorized requests to internal network endpoints, compromising the cloud infrastructure’s metadata. To address this issue, users should upgrade Red Hat Satellite to a patched version 6.19.x as soon as it is available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13316.