CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In JetBrains GoLand before 2026.2.2.1, missing authentication on the GoLand profiler's injected pprof server exposed profiling data.
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace.
In JetBrains IntelliJ IDEA before 2026.2.2, missing project-trust confirmation before building a Dev Container allowed host-level code execution.
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching.
In JetBrains IntelliJ IDEA before 2026.2.2, missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts.
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log.
In JetBrains YouTrack before version 2026.1.14047, a missing escalation check allowed a user with project update permissions to grant themselves the Project Admin role.
In JetBrains YouTrack before version 2026.1.14047, predefined search fields leaked all group names to any user, regardless of visibility permissions.
In JetBrains YouTrack before 2025.3.160480 and 2026.1.14047, PUT requests on link sub-resources allowed modification of linked entities without update permission.
In JetBrains YouTrack before version 2026.2.18769, changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials.
In JetBrains YouTrack before version 2026.2.18769, missing access control on Helpdesk authorized reporters exposed reporter email addresses.
In JetBrains YouTrack before version 2026.2.18687, missing permission checks allowed creating knowledge base articles in inaccessible projects.
In JetBrains YouTrack before 2026.2.18634, cloning a whiteboard allowed unauthorized changes to links on inaccessible issues.
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed read-only users to create and modify whiteboard cards.
In JetBrains YouTrack before 2026.2.18634, a shared token cache allowed cross-tenant theft of GitHub App installation tokens.
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads.
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed overwriting of bundled apps via the app import endpoint.
In JetBrains YouTrack before version 2026.2.18634, an IDOR in the user profile API disclosed private issues and starred folders across organizations.
In JetBrains YouTrack before version 2026.2.18634, an IDOR via the watchRules and issueListConfig endpoints exposed private saved searches.
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS