CVE Vulnerability Catalog

In JetBrains YouTrack before 2026.2.17917, unauthorized project transfer between organizations was possible.

In JetBrains YouTrack before 2026.1.13901 and 2026.2.17950, a DoS attack was possible via crafted type parameters.

In JetBrains YouTrack before 2026.1.13903 and 2026.2.17950, an authenticated user could read restricted articles from other projects via the draft creation endpoint.

In JetBrains YouTrack before 2026.2.18068, stored XSS via the fenced code-block language label was possible.

In JetBrains YouTrack before 2026.2.18177, a Denial of Service (DoS) attack was possible via a decompression bomb in the import endpoint.

In JetBrains YouTrack before 2026.2.18112, an authenticated user could enumerate accounts via the users search endpoint.

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, and 2026.2.18095, missing authorization allowed an authenticated user to delete arbitrary entities via the mailbox endpoint.

A vulnerability in jae-jae fetcher-mcp up to 0.3.9 affects the fetch_url/fetch_urls function in the URL Validation component, allowing a Server-Side Request Forgery (SSRF) attack. The attack can be launched remotely.

In PostCSS before 8.5.18, loadMap() in lib/previous-map.js passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map.

Prior to version 1.0.0-rc.18 in New API, user-controlled values (e.g., image count, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, billing-expression quantities) can overflow conversions in common/quota_math.go and related settlement paths. This allows a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds.

In JetBrains Ktor before 3.4.1, a potential Denial of Service (DoS) attack via WebSocket decompression was possible.

In New API before 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment.

In New API (LLM gateway and AI asset management system) from 0.9.1.3 to 1.0.0-rc.7, the AdminResetPasskey function in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account.

In New API prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high.

Prior to version 1.0.0-rc.7 in New API, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"). This allows an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs.

In Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted.

In Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group's activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material.

Prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 in Discourse, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers.

Discourse before versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 leaked hidden or otherwise unviewable first-post content as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers.