CVE Vulnerability Catalog

In JetBrains IntelliJ IDEA before 2026.1, code execution was possible via template injection in the Copyright plugin.

In JetBrains TeamCity before 2026.1, credentials could be exposed in thread names.

In JetBrains TeamCity before 2026.1, credentials parameters were exposed via parameter autocompletion.

In JetBrains TeamCity before 2025.11.2, sensitive data is exposed via default agent parameters.

In JetBrains TeamCity before 2026.1, insufficient username validation in the SAML plugin.

JetBrains TeamCity before versions 2026.1 and 2025.11.5 is vulnerable to reflected XSS on the repository download page. An attacker can inject a malicious script that executes in the victim's browser.

A vulnerability was found in JetBrains YouTrack before version 2026.1.13162 that allows information disclosure on the Users and Groups pages.

Shopper before version 2.8.0 does not check permissions for enable/disable, edit, and delete actions in admin tables for PaymentMethods, Currencies, and Carriers. A low-privilege user can disable payment methods, change the default currency, or disable carriers.

Shopper before version 2.8.0 has a vulnerability in Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files), where the store() method lacks authorization. Any authenticated user can modify prices, stock, SEO metadata, shipping dimensions, and attachments of any product.

In Shopper, a headless e-commerce admin panel prior to version 2.8.0, the CreateOrderFromCartAction::execute function created the order before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied while the counter blocked at the limit. The merchant had no signal of over-redemption.

liboqs prior to version 0.16.0 has an out-of-bounds read vulnerability in the XMSS and XMSS^MT signature verification code, potentially leading to a crash (denial of service).

SillyTavern before version 1.18.0 contains an SSRF vulnerability in corsProxyMiddleware, which forwards the URL from req.params.url directly into fetch(). Only circular requests to its own host are blocked, with no destination allowlist or private/loopback restrictions.

SillyTavern before version 1.18.0 does not HTML-escape attacker-controlled URL values before sending them in error responses. This allows cross-site scripting (XSS) via crafted requests.

In Danelec MacGregor Voyage Data Recorder, passwords are stored with a hashing method that limits password length and is susceptible to brute force attacks.

In liboqs before 0.16.0, an out-of-bounds read occurs in XMSS/XMSS^MT signature verification when the signature buffer is shorter than expected. The implementation does not validate the length and reads past the buffer, potentially causing a crash (DoS).

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device, which includes account data and password hashes.

The administrator account of the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive authentication files, potentially changing the root password.

Statamic prior to versions 5.73.22 and 6.18.1 contains a vulnerability in the Glide image proxy. URL validation could be bypassed, allowing an unauthenticated attacker to make HTTP requests to internal addresses (loopback, private network, cloud metadata).

In Arcane 1.18.1 and earlier, the GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitizer blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.

Neotoma from 0.6.0 to before 0.11.1 can treat public reverse-proxied requests as local when received over a loopback socket without a Bearer token. This allows unauthenticated access to the Inspector and related API surface.