CVE Vulnerability Catalog

In JetBrains YouTrack before version 2026.2.19197, project administrators could read comments from other projects via notification templates.

In JetBrains Hub before version 2026.2.52366, missing authorization allowed authenticated users to send arbitrary emails from the server's trusted address.

In JetBrains YouTrack before version 2026.2.18991, missing authorization allowed users with read-only project access to overwrite project notification templates.

In JetBrains IntelliJ IDEA before version 2026.2.3, remote code execution (RCE) via Structural Search script constraints was possible in untrusted projects.

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, administrator account takeover was possible via password reset.

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, authenticated users can execute commands on Windows servers via CRLF injection in Pipeline Git connection settings.

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, a sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL.

The Business Directory plugin (business-directory-plugin) in WPTasty contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. The issue affects versions from n/a through 6.4.27.

AJA HELO Plus firmware before version 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware.

Trex MES from Trex Digital Smart Manufacturing Systems Inc. contains a missing authentication for critical function vulnerability, allowing authentication bypass. The issue affects versions through 2026-09-29.

OpenSave through version 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

LightLLM through version 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

Astro is a web framework for content-driven websites. Prior to version 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash.

Path traversal / arbitrary file write vulnerability in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

Contributor SQL Injection vulnerability in Media Library Assistant versions up to 3.41.

The Quiz And Survey Master (quiz-master-next) WordPress plugin contains a DOM-Based Cross-site Scripting vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 11.2.6.

The Event Tickets plugin (Liquid Web / StellarWP) is vulnerable to SQL Injection (Blind SQL Injection) due to improper neutralization of special elements in SQL commands. This issue affects Event Tickets from n/a through 5.29.5.

The Premmerce Permalink Manager for WooCommerce plugin in versions up to and including 2.3.13 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

The WPFunnels plugin in versions up to and including 3.13.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.