CVE-2026-114376 is a path traversal vulnerability in leomoon-studios wiki-go affecting versions 1.9.0 and 1.9.1. The flaw exists in the SaveHandler/SourceHandler functions within the internal/handlers/editor.go file of the API component. This vulnerability allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The issue is resolved by upgrading to version 1.9.2.
### Summary
Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.
In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel.
### Details
The normal handler performs the expected authorization check before creating the WebSocket connection:
https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/services/kernels/websocket.py#L39-L47
The gateway handler only checks `current_user` and then opens the upstream channel. It never calls `authorizer.is_authorized(...)`:
https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L49-L75
https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L87-L98
Gateway mode selected that handler automatically by replacing handlers with matching routes:
https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/serverapp.py#L437-L446
PR #1261 stopped replacing the normal handler and routed gateway traffic through `GatewayWebSocketConnection` instead. This appears to have fixed the default gateway configuration in 2.6.0, although the deprecated handler is still present in current releases and can still be registered directly.
https://github.com/jupyter-server/jupyter_server/pull/1261
### Code-level validation
1. Configure a custom Authorizer that returns false for `execute` on `kernels` for a regular authenticated user.
2. Configure `GatewayClient.url` on Jupyter Server 2.0.0-2.5.0.
3. The normal `KernelWebsocketHandler` would reject that user with 403 in `pre_get`.
4. Gateway mode replaces it with `WebSocketChannelsHandler`. Its `authenticate` method only rejects anonymous users, and `get` proceeds to the upstream gateway without an authorization decision.
### Impact
This is a missing authorization check, not an authentication bypass. It matters in deployments that use a restrictive custom Authorizer and Jupyter Gateway/Enterprise Gateway. A read-only or otherwise limited authenticated user can cross the intended authorization boundary and obtain kernel execution, with access to data and credentials available to that kernel.
### Affected versions
- Default gateway configuration: 2.0.0 through 2.5.0
- 2.6.0 and later: the default path uses the authorized standard handler, but manually registering the deprecated `jupyter_server.gateway.handlers` module still exposes the old behavior.
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
CVE-2026-114438 is an authentication flaw in the Red Hat Build of Keycloak identity and access management solution. The issue occurs when the Update User Locale required action is executed before the Configure OTP action within a realm, potentially allowing users to bypass mandatory multi-factor authentication (MFA) enrollment. An attacker with a valid password may access an account without setting up the required one-time password (OTP) credential. The vulnerability has a medium severity rating with a CVSS score of 4.2. No affected versions or patch information are explicitly provided in the available data.
CVE-2026-114374 is a server-side request forgery (SSRF) vulnerability in leomoon-studios wiki-go affecting versions 1.9.0 and 1.9.1. The issue exists in the fetch-metadata endpoint within the internal/handlers/metadata_api.go file. This vulnerability allows remote attackers to manipulate requests, potentially causing the server to make unintended requests. A public exploit is available. Upgrading to version 1.9.2 addresses this vulnerability.
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled.
This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 are vulnerable to HTTP request smuggling via HEAD requests that include Content-Length or Transfer-Encoding headers. This vulnerability is identified as CWE-444, involving inconsistent interpretation of HTTP requests. The issue allows attackers to interfere with request processing, potentially leading to information disclosure and request manipulation. Upgrading to versions 9.2.16, 10.1.5, or 10.2.1 addresses this vulnerability.
CVE-2026-114362 is a server-side request forgery (SSRF) vulnerability in HarnessRouter versions up to 0.31.12. The flaw exists in the Targets Test Endpoint component within the gateway/app.py file, where manipulation of the base_url argument can lead to SSRF. This vulnerability can be exploited remotely. Upgrading to version 0.31.13 addresses the issue.
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.
CVE-2026-114268 is a critical buffer overflow vulnerability in the Tenda BE3L Pro router firmware version 16.03.60.62. The flaw exists in the formWifiBasicSet function within the /goform/WifiBasicSet file, where improper handling of the security_5g argument allows remote attackers to cause a buffer overflow. Exploit code has been published, increasing the risk of exploitation. No patch information is currently available.