90910 matches found
CVE-2026-100255: Improper Validation of Unsafe Equivalence in Input
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...
CVE-2026-97250: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...
CVE-2026-97247: Missing Authorization
Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...
CVE-2026-102145: Improper Neutralization of CRLF Sequences
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...
CVE-2026-102140: Insufficient Verification of Data Authenticity
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...
CVE-2026-97241: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in BackupEase = 2.2.2 versions...
CVE-2026-97237: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...
CVE-2026-93770: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.13 versions...
CVE-2026-102138: Server-Side Request Forgery (SSRF)
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...
CVE-2026-100279: Server-Side Request Forgery (SSRF)
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...
CVE-2026-100257: Server-Side Request Forgery (SSRF)
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...
CVE-2026-100256: Inclusion of Functionality from Untrusted Control Sphere
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects...
CVE-2026-27371: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WPFunnels = 3.13.1 versions...
CVE-2026-97267: Missing Authorization
Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...
CVE-2026-102143: Missing Authentication for Critical Function
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...
CVE-2026-102395: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Easy Google Maps = 1.14.6 versions...
CVE-2026-94171: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18...
CVE-2026-100274: Allocation of Resources Without Limits or Throttling
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template...