CVE-2018-25420: Improper Neutralization of Special Elements used in an SQL Command

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database informati...

CVE-2026-49385: Missing Authorization

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts...

CVE-2026-49384: Improper Neutralization of Input During Web Page Generation

In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible...

CVE-2026-49380: URL Redirection to Untrusted Site

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible...

CVE-2026-49378: Missing Authorization

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion...

CVE-2026-49370: Insertion of Sensitive Information Into Sent Data

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests...

CVE-2026-49367: Missing Authorization

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account...

CVE-2026-44611: Use of Password Hash With Insufficient Computational Effort

Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks...

CVE-2026-42929: Use of Hard-coded Credentials

Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials...

CVE-2026-49196: Improper Neutralization of Special Elements used in a Command

The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands...

CVE-2026-49376: Incorrect Authorization

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin...

CVE-2026-49366: Improper Neutralization of Special Elements used in an OS Command

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion...

CVE-2026-49379: Insufficiently Protected Credentials

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names...

CVE-2026-49377: Cleartext Storage of Sensitive Information in an Environment Variable

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters...

CVE-2026-49373: Improper Neutralization of Argument Delimiters in a Command

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings...

CVE-2026-42500: Undefined Security Weakness

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image...

CVE-2026-49199: Improper Neutralization of Special Elements used in a Command

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device...

web-vulnerability-scanner

web-vulnerability-scanner A P...

CVE-2026-9645: Improper Neutralization of Special Elements used in an OS Command

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root...

CVE-2026-9039: Initialization of a Resource with an Insecure Default

A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default...