Gogs Trio of Critical Flaws Enables Full Server Takeover

Gogs disclosed three critical-severity vulnerabilities that, taken together, give an authenticated attacker a near-complete server compromise chain. CVE-2026-52806 allows remote code execution via argument injection in git rebase --exec during pull-request merge — an attacker crafts a branch name that injects arbitrary commands. CVE-2026-52813 lets organization names containing path-traversal sequences (../) write repository data to arbitrary filesystem locations. CVE-2026-52811 bypasses symlink checks during file upload, checking only the leaf path rather than intermediate directories. Any organization hosting Gogs should treat these as an emergency patch cycle: the RCE vector alone, combined with the path-traversal and symlink flaws, means a single authenticated user can escalate to full server control.

Budibase disclosed a critical server-side prototype pollution and RCE vulnerability in its query enrichment pipeline. CVE-2026-54350 lives in enrichContext at packages/server/src/sdk/workspace/queries/queries.ts, where user-supplied parameter values are substituted into raw JSON query bodies and then passed to JSON.parse. The validateQueryInputs validator runs before this substitution but does not prevent injection of JSON metacharacters that break the parse structure. An attacker with workspace access can craft query parameters that pollute the prototype chain or inject arbitrary JavaScript execution contexts. Budibase instances exposing query functionality to untrusted users should apply the forthcoming patch immediately.

OpenAM disclosed two high-severity flaws that together allow session token theft and lateral movement across federated environments. CVE-2026-45049 is an information-exposure issue in the Cross-Domain Single Sign-On (CDSSO) servlet: a logged-in user's raw OpenAM session token is POSTed to an attacker-controlled URL, leaking the authentication credential. CVE-2026-45048 is an insufficient-authorization bug in the session management endpoint that lets a low-privileged authenticated user retrieve active session credentials belonging to other users. Organizations using OpenAM for SSO should audit CDSSO configurations and restrict access to session-management APIs while patches are evaluated.

Jenkins released its June 2026 security advisory, addressing a moderate-severity cross-site request forgery vulnerability in the Pipeline: Groovy Plugin. CVE-2026-57283 (CVSS 6.5) allows an attacker to make unauthorized configuration changes via CSRF, as detailed in the Jenkins Security Advisory 2026-06-24. Jenkins administrators should update the Pipeline: Groovy Plugin and review CSRF token enforcement settings. While not a critical-severity issue, the ubiquity of Jenkins in CI/CD pipelines makes this a high-priority patch for any organization running the affected plugin.

A cluster of seven Linux kernel netfilter, Bluetooth, SCTP, io_uring, and IPC flaws were disclosed, all rated moderate-to-important with CVSS 7.0. CVE-2026-52942 (nf_log missing MAC header validation), CVE-2026-52920 (xt_policy strict-mode matching bypass), CVE-2026-52923 (IPC next_id allocation out-of-range), CVE-2026-52918 (Bluetooth accept_q race condition), CVE-2026-52924 (SCTP stale COOKIE-ECHO outqueue purge), CVE-2026-52940 (tun vnet header zeroing), and CVE-2026-52943 (skbuff zerocopy reference leak) each present local or adjacent-network attack surfaces. CVE-2026-52933 in io_uring/poll involves a signed comparison bug in io_poll_get_ownership. While none are remotely exploitable without prior access, they represent a significant batch of kernel hardening patches that enterprise Linux teams should prioritize in their next maintenance window.

Several open-source tools disclosed high-severity flaws enabling arbitrary file read, command injection, or privilege escalation. CVE-2026-55488 in motionEye (absolute path traversal in media file handlers), CVE-2026-55441 in mise (task-include files bypass trust checks), CVE-2026-54134 in OctoPrint (file exfiltration via FILE_UPLOAD permission), CVE-2026-53925 in Glances (shell metacharacter injection in secure_popen()), and CVE-2026-13208 in KubeVirt (virt-handler trusts VMI identity from unauthenticated gRPC requests). Each affects widely deployed self-hosted tools — motionEye for surveillance, mise for dev-environment management, OctoPrint for 3D printing, Glances for system monitoring, and KubeVirt for VM orchestration on Kubernetes. Teams running these should review the specific preconditions (authenticated access, specific permissions) and patch where exposure to untrusted users exists.