Knowledge Base

In Gitea versions prior to 28.2.0 a high severity vulnerability CVE-2026-109553 was detected. This vulnerability allows an attacker to authenticate as another user by registering that user’s public key as their own principal when a user certificate authority is trusted. To address this issue, users should upgrade Gitea to version 28.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-109553.

In Blaze Demo Importer component for WordPress versions 1.0.16 and earlier a medium severity vulnerability CVE-2026-106933 was detected. This vulnerability allows authenticated users with the Author role or higher to upload a crafted SVG file that executes arbitrary JavaScript in the browser of any user who opens it. To address this issue, users should upgrade Blaze Demo Importer to version 1.0.17 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-106933.

In Gitea versions prior to 28.2.0 a medium severity vulnerability CVE-2026-104627 was detected. This vulnerability allows an attacker-controlled OpenID provider to attach the attacker’s identity to a victim’s account and then sign in as the victim, bypassing TOTP and WebAuthn checks. To address this issue, users should upgrade Gitea to version 28.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-104627.

In Bootstrap Shortcodes component for WordPress versions prior to 3.4.6 a medium severity vulnerability CVE-2026-112111 was detected. This vulnerability allows authenticated users with Contributor-level access or higher to inject arbitrary web script that runs in the browser of any user viewing the page. To address this issue, users should upgrade Bootstrap Shortcodes to version 3.4.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-112111.

In Gitea versions prior to 28.2.0 a medium severity vulnerability CVE-2026-105964 was detected. This vulnerability allows a user holding a workflow runner token to exhaust server memory and crash the Gitea process by sending an oversized request to the artifact service. To address this issue, users should upgrade Gitea to version 28.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-105964.

In Docling versions prior to 2.94.0 a high severity vulnerability CVE-2026-47214 was detected. This vulnerability may allow an attacker to access unauthorized local files, bypass access restrictions, or potentially perform Server-Side Request Forgery (SSRF) attacks. This occurs due to unsafe URI and path handling within the HTML backend. By supplying a specially crafted URI or file path, an attacker can manipulate the application’s resource resolution mechanisms, forcing the backend to access or process unintended and potentially malicious resources. To address this issue, users should upgrade Docling to version 2.94.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47214.