Knowledge Base

In Docling versions prior to 2.94.0 a high severity vulnerability CVE-2026-47214 was detected. This vulnerability may allow an attacker to access unauthorized local files, bypass access restrictions, or potentially perform Server-Side Request Forgery (SSRF) attacks. This occurs due to unsafe URI and path handling within the HTML backend. By supplying a specially crafted URI or file path, an attacker can manipulate the application’s resource resolution mechanisms, forcing the backend to access or process unintended and potentially malicious resources. To address this issue, users should upgrade Docling to version 2.94.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47214.

In affected versions of Gitea a high severity vulnerability CVE-2026-107618 was detected. This vulnerability allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack, resulting in the unauthorized modification of a repository’s topics. This occurs because the POST /{owner}/{repo}/topics endpoint was registered without the necessary sign-in middleware that enforces cross-origin protection. Consequently, if an authenticated repository administrator is tricked into visiting a malicious third-party webpage, the site can forge and send a valid request to alter the repository’s topics without the user’s consent. Note that no other repository settings are reachable or modifiable through this specific route. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-107618.

In Jenkins versions 2.587 and earlier, and LTS 2.580.1 and earlier a low severity vulnerability CVE-2026-117624 was detected. This vulnerability allows an attacker to bypass root element checks and potentially inject unauthorized nested objects. This occurs due to inconsistent enforcement of deserialization restrictions. Specifically, Jenkins fails to correctly restrict the deserialization of object types that are marked as storing their configuration in independent top-level configuration files when they are processed as nested values. By submitting a specially crafted payload, an attacker can evade the intended root element validation and inject malicious nested objects into the system. To address this issue, users should upgrade Jenkins to a patched version (such as 2.588, LTS 2.580.2, or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-117624.

In Grafana versions from 11.6.0 before 11.6.15, 12.2.0 before 12.2.9, 12.3.0 before 12.3.7, 12.4.0 before 12.4.4, and 13.0.0 before 13.0.2 a high severity vulnerability CVE-2026-33382 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition by exhausting system memory. This occurs because several Grafana API endpoints—including some that are unauthenticated—do not properly limit the size of the request body before processing it. By sending excessively large payloads, an attacker can force the application into excessive memory allocation, which may exhaust available memory and render the service unresponsive or cause it to crash. To address this issue, users should upgrade Grafana to versions 11.6.15, 12.2.9, 12.3.7, 12.4.4, 13.0.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33382.

In GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 a critical severity vulnerability CVE-2026-97229 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the GitLab server, potentially leading to a complete system compromise. This occurs due to an integer overflow or wraparound flaw caused by insufficient regular expression validation. By supplying a specially crafted regular expression within a CI/CD configuration, an attacker can trigger this vulnerability and execute unauthorized commands on the underlying server. To address this issue, users should upgrade GitLab CE/EE to versions 19.2.8, 19.3.5, 19.4.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-97229.

In Dokploy versions up to and including 0.30.10 a high severity vulnerability CVE-2026-116068 was detected. This vulnerability allows an authenticated attacker, specifically an owner or admin of one organization, to bypass authorization controls and manipulate applications belonging to other tenants. This occurs within the Application tRPC Router, which fails to properly validate the ownership of the supplied applicationId. By providing a foreign applicationId, an attacker can invoke sensitive procedures such as saveEnvironment, updateTraefikConfig, deploy, or stop. This leads to unauthorized actions including the overwriting of environment variables and build secrets, repointing of application sources, and complete disruption of other tenants’ applications. To address this issue, users should apply the specific remediation patch committed in the source code (commit b3cd3c5). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-116068.