CVE-2026-129455

The Zr.Admin.NET project (commits e6ceaf4 through eb9228a ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the FrontArticleController component. This flaw allows authenticated users to manipulate the visibility and pin state of articles belonging to other users. Specific...

PT-2026-147446

Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId...

JetBrains YouTrack < 2026.2.18991 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18991. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification template...

CVE-2026-100261

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission...

CVE-2026-100261

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission...

EUVD-2026-90005

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission...

CVE-2026-100261

In JetBrains YouTrack versions prior to 2026.2.18991 , a vulnerability exists that allows users to change article visibility settings without having the required update permission . This flaw potentially impacts the integrity of content visibility within the platform. Remediation is available in ...

CVE-2026-100261: Authentication Bypass Using an Alternate Path or Channel

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission...

PT-2026-103308

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description An issue exists where users can change article visibility settings without possessing the required update permission. Recommendations Update to version 2026.2.18991...

CVE-2024-39313 toy-blog Improper Input Validation vulnerability

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workaroun...