CVE Vulnerability Catalog

In JetBrains YouTrack before version 2026.2.19197, users with low-level Admin Read permission could disclose integration credentials via import configurations.

In JetBrains YouTrack before version 2026.2.18991, stored SMTP server credentials could be disclosed by changing the server host.

Astra WordPress Theme versions up to 4.13.12 are vulnerable to Content Injection by a shop manager.

Claude Code selected an API key stored by Claude Code (e.g., from an earlier /login or written to its configuration) ahead of the user's valid Claude Enterprise or Team sign-in when fetching server-managed settings. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy or kept applying a stale copy, while continuing to operate as the organization's account. This required local access to a device with such a stored API key. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work from 2.1.38. Users on auto-update have received the fix; manual update to 2.1.260 or later is advised.

A flaw was found in Moodle where user list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

A flaw was found in Moodle where an incorrect capability check in the AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.

A flaw was found in Moodle where the manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.

A flaw was found in Moodle that allows an authenticated attacker to supply an improperly validated audience class name to the Report Builder component, enabling arbitrary class instantiation. This vulnerability enables unauthorized creation of internal program objects, which may result in unexpected application behavior.

The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured. This allows unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.

The Schema & Structured Data for WP & AMP WordPress plugin before version 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.

A weakness was identified in gedelumbung HospitalManagement affecting the detail function (application/modules/admin/controllers/laporan_data_pasien.php). Manipulation of the id_param argument leads to authorization bypass. The attack can be launched remotely, and the exploit is publicly available.

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export function temporarily clears defensive restrictions during dynamic schema manipulation. A vulnerability in handling the source database name parameter allowed a crafted source name to execute statements otherwise blocked, leading to modifications of the sqlite_schema table and database corruption.

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This is a classic cross-site scripting (XSS) vulnerability.

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions. This may lead to execution of untrusted JavaScript code.

A vulnerability was identified in Freedesktop Poppler up to version 26.08.0 in the function SplashClip::clipToPath of file splash/SplashClip.cc. Manipulation leads to an integer overflow. The attack can only be performed from a local environment.

A vulnerability was found in Poppler versions 26.06.0, 26.07.0 and 26.08.0 in the function FoFiTrueType::cvtSfnts of file fofi/FoFiTrueType.cc, causing an integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized.

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could interrupt the normal operation of the affected service, which recovers without manual intervention.

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of the affected service.

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service.