Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the unacceptedassets report process. An attacker can obtain sensitive inventory details and assignee names belonging to...

CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

EUVD-2026-72500

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-86484

JetBrains YouTrack before version 2026.2.18634 is vulnerable to a stored cross-site scripting (XSS) flaw caused by AngularJS template injection in assignee names. An authenticated user (low privileges) can craft a malicious assignee name that, when viewed by another user, executes arbitrary scrip...

CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

PT-2026-86856

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-86484: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-5712

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing...

CVE-2026-5712

IdentityIQ (all versions) is affected: an authenticated user who is the requestor or assignee of a work item can edit a role definition without having the capability to do so. Underlying issue is incorrect authorization. CVSS v3.1 base score 8.0 (HIGH) with network attack vector, high complexity,...

CVE-2026-5712 IdentityIQ Role Editor Incorrect Authorization Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing...

CVE-2026-5712 IdentityIQ Role Editor Incorrect Authorization Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing...

BIT-DISCOURSE-2026-32607 Discourse: Stored XSS via unescaped assignee name

Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.3, and 2026.2.0 to before 2026.2.2, when the hidden prioritizefullnameinux site setting is enabled defaults to false, requires console access to change, user and group display names are rendered without HTML...

CVE-2026-32607

Discourse (open‑source) is affected by a Stored XSS in displays of user/group names when the hidden prioritize_full_name_in_ux setting is enabled. Affected versions range from 2026.1.0-latest up to but not including 2026.1.3, 2026.2.0-latest up to but not including 2026.2.2, and 2026.3.0-latest u...

CVE-2026-32607 Discourse: Stored XSS via unescaped assignee name

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritizefullnameinux site setting is enabled defaults to false, requires console access to change, user...

CVE-2026-32607 Discourse: Stored XSS via unescaped assignee name

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritizefullnameinux site setting is enabled defaults to false, requires console access to change, user...

CVE-2026-32607 Discourse: Stored XSS via unescaped assignee name

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritizefullnameinux site setting is enabled defaults to false, requires console access to change, user...

Linux Distros Unpatched Vulnerability : CVE-2021-39876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. CVE-2021-39876 Note that...

Linux Distros Unpatched Vulnerability : CVE-2021-39911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all version...

CVE-2021-39911

An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers...