CVE-2026-6223

In JetBrains Hub before 2026.2.52442, an unauthenticated attacker could register a trusted service and gain superuser privileges.

In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM through 07092026. The vendor was contacted but did not respond.

In 389 Directory Server, during SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

LibreNMS before version 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. A low-privileged operator with SSH access to the SCG host can gain root-level access without a password by leveraging the exposed Docker socket. Additionally, an attacker who compromises a service within the orchestrator container can access the same socket and escape the container to obtain host-level control.

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. The attacker can execute commands remotely on a target system by sending a specially crafted request to the application, bypassing intended restrictions on code execution.

A vulnerability was detected in Linksys RE7000 2.0.15. It affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest in the PingTest Handler component. Manipulation of the arguments pingTestIp/pingTestPktSize/pingTestTimes results in OS command injection. The attack can be launched remotely. The exploit is now public and may be used.

A vulnerability was found in D-Link DIR-822A A_101 in the strcpy function of the file udhcpcd/serverpacket.c in the udhcpcd component. This manipulation causes a stack-based buffer overflow. The attack can be carried out remotely and the exploit is publicly disclosed.