CVE-2026-72657: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...

CVE-2026-8387

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting .zip archives using the ZipFile.extractall method in StorageManager.extracttocache. This issue arises due to the lack of path traversal validation, enabling an attacker to...

EUVD-2023-41892

Malicious code in bioql PyPI...

CVE-2023-38066

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads...

CVE-2023-38066

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads...

CVE-2023-38066

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads...

Cross site scripting

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads...

CVE-2023-38066

Summary (CVE-2023-38066) : JetBrains TeamCity versions prior to 2023.05.1 are affected by a reflected XSS vulnerability that can be triggered via the Referer header during artifact downloads. The issue is triggered in the web UI when user-supplied Referer data is reflected back, potentially enabl...

CVE-2023-38066

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads...

CVE-2023-38066

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads...

PT-2023-26278 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05.1 Description: The issue allows for reflected XSS via the Referer header during artifact downloads. Recommendations: For versions prior to 2023.05.1, update to version 2023.05.1 or later to resolve...

CVE-2023-38066: Improper Neutralization of Input During Web Page Generation

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads...

Content-Security-Policy protection for user content disabled by ZAP Pipeline

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts. ZAP Pipeline 1.9 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins. Th...