EUVD-2026-90379

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102096 Kiteworks Core OS command injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102099 Kiteworks Core arbitrary file write

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially...

CVE-2026-102094

The Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection . The vulnerability exists because the mail-processing pipeline fails to sufficiently restrict code loaded from an imported rule configuration . An authenticated administrator with mail-rule configurati...

CVE-2026-102093 Kiteworks Core improper privilege management

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full...

EUVD-2026-90205

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474

The yii2-starter-kit software, through version 4.2.0 , contains an Unrestricted File Upload vulnerability in the backend storage upload actions. The root cause is a failure to validate file types, which allows authenticated users with the manager role to upload PHP files . An attacker can leverag...

CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

redis-cve-2026-23479-check

redis-cve-2026-23479-check Безопасная, только для чтения проверка версии для CVE-2026-23479 — использование после освобождения use-after-free в коде блокирующих клиентов Redis, которое позволяет аутентифицированному пользователю выполнить удаленный код на хосте. Инструмент не эксплуатирует...

CVE-2026-62308

Prior to version 1.30.6 , Tugtainer (a self-hosted app for automating Docker container updates) is vulnerable to an authenticated blind server-side request forgery (SSRF) . The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocol...

EUVD-2026-90083

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-100271

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects...

CVE-2026-100266

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

CVE-2026-100271

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects...

CVE-2026-100271

In JetBrains YouTrack versions prior to 2026.2.19197 , a missing authorization vulnerability on several endpoints allows authenticated users to access information from projects they are not authorized to view. The vulnerability results in a LOW confidentiality impact. No specific exploit details ...

CVE-2026-100266

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

CVE-2026-100266

In JetBrains Hub versions prior to 2026.2.52366 , a missing authorization vulnerability allows authenticated users to send arbitrary emails from the server's trusted address. This flaw impacts the integrity of communications sent via the hub. Remediation is available in version 2026.2.52366 or la...

EUVD-2026-90010

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

SUSE CVE-2026-102830

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-13719

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...