CVE Vulnerability Catalog

In JetBrains Rider before 2026.2.1 AI Assistant could auto-update third-party skills without user confirmation. This may lead to unauthorized changes in the environment.

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible. Malicious content could be stored and displayed to other users.

In JetBrains YouTrack before version 2026.2.18991, changing article visibility settings was possible without update permission.

In JetBrains YouTrack before version 2026.2.18991, mailbox integration allowed authentication after a password reset.

In JetBrains YouTrack before version 2026.2.18991, improper access control on Gantt chart allowed edits by users with view-only access.

In JetBrains YouTrack before version 2026.2.18991, missing authorisation allowed read-only users to read project settings.

In JetBrains YouTrack before version 2026.2.18991, SSRF via stored XHTML injection was possible during PDF export.

Authorization bypass through user-controlled key vulnerability in Pay with Vipps for WooCommerce allows exploiting incorrectly configured access control security levels. Affects versions from n/a through 6.2.4.

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output, which can allow crafted values to be interpreted as SVG markup. Version 0.33.5 contains a patch.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in User Submitted Posts allows Stored XSS. Affects versions from n/a through 20260810.

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.

MISP contains a stored XSS vulnerability in the galaxy icon handling path. The icon field is persisted without server-side validation and later concatenated into HTML by correlation graph rendering scripts. A user with perm_galaxy_editor can store arbitrary HTML/JavaScript that executes in another user's browser when viewing the correlation graph.

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink when the value passes FILTER_VALIDATE_URL, which accepts javascript: URIs. A user with galaxy editor privileges can store a javascript: URL, and when another user clicks it, the script executes in their browser.

LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated SSRF. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.

GPAC up to 26.07.0 has a buffer overflow vulnerability in the function gf_dash_resolve_url in src/media_tools/dash_client.c of the DASH Client component. The attack can be carried out remotely. Upgrading to version abi-16.26 resolves the issue.

A vulnerability was identified in Artifex Ghostscript up to 10.07.0 in the function type1_callsubr of the file devices/vector/gdevpsfx.c of the Pdfwrite component. The manipulation leads to a stack-based buffer overflow, and remote exploitation is possible. The exploit is publicly available and might be used.

Blosc C-Blosc2 up to 3.3.2 has an integer overflow vulnerability in the function blosclz_decompress in blosc/blosclz.c of the blosclz Decompression component. The attack can be launched remotely but is difficult to exploit. Upgrading to version 3.3.3 fixes the issue.

Astro from 5.2.0 to 8.2.4 has a vulnerability in the @astrojs/netlify adapter that generates regexes for Netlify Image CDN remote-image allowlists without anchoring them to the URL start. This allows an attacker to control the actual host while an allowed origin appears only in the path or query. An unauthenticated request to /.netlify/images can cause the Image CDN to request attacker-selected URLs, potentially probing internal services. Fixed in version 8.2.4.

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.