CVE Vulnerability Catalog

A vulnerability in ash-project usage_rules involves improper neutralization of escape, meta, or control sequences in output. A malicious package publisher can inject terminal control sequences into the output of mix usage_rules.search_docs. When a developer runs a search, these sequences reach the terminal unchanged, potentially forging displayed URLs, hiding text, or writing to the clipboard. Affects usage_rules from 0.1.18 before 1.2.8.

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.

The vulnerability in SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests with deeply nested entity definitions, which could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact on availability with no impact on confidentiality and integrity.

A vulnerability in the igniter library of the ash-project allows a malicious package publisher to forge the mix igniter.install confirmation prompt. The metadata fields are not properly neutralized, allowing ANSI escape sequences to overwrite the confirmation panel, hiding real information and presenting fake author names or download counts.

A vulnerability in ash_double_entry of the ash-project allows an attacker to submit several distinct string spellings of the same ULID identifier. Due to improper masking of the first character, multiple strings decode to the same value, enabling desynchronization of string-level checks such as idempotency keys or deny-lists.

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace.

In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching.

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log.

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads.

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content.

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank.

In JetBrains YouTrack before 2026.2.18634 IP spoofing via HTTP headers allowed forged Bitbucket webhooks.

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker supplying a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation and the file write operation to write to policy-denied locations.

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.

In the Hospital Information System 1.0 from code-projects, in the file /HIS/src/patients/editPatient.php within the Patient Management component, manipulation of the argument ID leads to cross-site scripting (XSS). The attack can be launched remotely, and the exploit has been publicly disclosed.