35051 matches found
CVE-2026-86481
JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in which signed URL reuse allowed disclosure of restricted project icons . The underlying cause is the reuse of signed URLs, enabling an authenticated low-privilege user to access project icon resources that should re...
CVE-2026-74248
A flaw was found in OpenStack Octavia. An authenticated user can exploit this vulnerability by associating a Quality of Service QoS policy from another project with an amphora. This mishandling of QoS policy authorization may prevent the deletion of the policy, leading to a denial of service DoS...
WordPress Zephyr Project Manager plugin <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability
Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Zephyr Project Manager versions = 3.3.205...
PT-2026-86872
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...
PT-2026-86863
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-82586: Improper Protection of Alternate Path
Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...
PT-2026-86875
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
PT-2026-86876
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...
PT-2026-86877
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...
CVE-2026-86505: Insertion of Sensitive Information Into Sent Data
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...
PT-2026-86869
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
CVE-2026-82758: Improper Authentication
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
CVE-2026-82756: Improper Encoding or Escaping of Output
Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...
CVE-2026-82755: Use of Cache Containing Sensitive Information
Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
CVE-2026-82584: Improper Neutralization of Escape, Meta, or Control Sequences
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...
CVE-2026-86497: Insertion of Sensitive Information Into Sent Data
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
PT-2026-86929
Name of the Vulnerable Software and Affected Versions igniter versions 0.8.1 through 0.8.3 Description Improper neutralization of escape, meta, or control sequences allows a malicious package publisher to forge the mix igniter.install confirmation prompt. The panel builder in Igniter.Project.Deps...
CVE-2026-86500: Incorrect Privilege Assignment
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...
