CVE Vulnerability Catalog

In JetBrains YouTrack before 2026.2.18634, cloning a whiteboard allowed unauthorized changes to links on inaccessible issues.

In JetBrains YouTrack before 2026.2.18634, a shared token cache allowed cross-tenant theft of GitHub App installation tokens.

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation.

In JetBrains YouTrack before versions 2026.2.18788, 2026.1.14055, and 2025.3.161254, missing authorization allowed access to restricted REST API resources via IDOR.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an OS Command Injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Incorrect Operator vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Path Traversal. This issue affects CSM (Customer Service Management): from 6.8.9 before 8.0.3.

A flaw in 389-ds-base, in the Cockpit 389 Console's LDAP editor. An LDAP entry's DN is embedded into a shell command without proper escaping. A user with delegated privileges could craft a malicious DN with shell metacharacters, leading to command execution with root privileges when viewed by an administrator.

A missing NULL pointer check in the paged results handling of op_shared_search in 389 Directory Server. An unauthenticated remote attacker can crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

A heap buffer overflow in the SASL I/O layer of 389 Directory Server. In sasl_io_start_packet(), the wrapped-record length is only validated against an upper bound. A small wire length causes an unsigned underflow, leading to a read of about 4 GiB into a 1024-byte heap buffer. A remote authenticated attacker after a successful SASL bind with integrity protection can cause denial of service or potentially remote code execution.

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format, causing the supplied value to be persisted more than once per request. The fix adds a maximum email input length of 1024 bytes, email-format validation, a per-source pre-authentication request budget, HTTP 429 responses, a 15-minute cooldown, and POST-only handling with CSRF protection.

Improper Certificate Validation vulnerability in Dell SCG 5.0 Appliance (before 5.36.00.16) and Dell SCG 5.0 Application (before 5.36.00.00). An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Path Traversal vulnerability in Dell SCG 5.0 Appliance (before 5.36.00.16) and Dell SCG 5.0 Application (before 5.36.00.00). An unauthenticated attacker with remote access could exploit this, leading to remote code execution.

Relative Path Traversal vulnerability in Dell SCG 5.0 Appliance (before 5.36.00.16) and Dell SCG 5.0 Application (before 5.36.00.00). A low privileged attacker with remote access could exploit this, leading to remote code execution.