327 matches found
JetBrains YouTrack < 2026.2.19422 Multiple Vulnerabilities
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.19422. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible. CVE-2026-103493 - In JetBrains YouTrack before...
CVE-2026-123326
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension...
CVE-2026-123289: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files...
CVE-2026-123286: JetBrains Datalore: In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token...
CVE-2026-58273 Rucio: Authorisation Bypass on REST API endpoint for signing URLs
Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ'issuer' by token authentication. Any authenticated low-privilege user can supply root as the...
CVE-2025-6710
MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which coul...
CVE-2026-14851 Unauthorised disclosure of information on Copart’s online billing service
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...
CVE-2026-14851
The Copart online billing service suffers from a vulnerability that leads to the unauthorised disclosure of information within its customer invoicing web application. The root cause is a lack of authorisation checks on the endpoint responsible for serving PDF invoice files , combined with certain...
CVE-2026-14851 Unauthorised disclosure of information on Copart’s online billing service
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...
CVE-2026-105786 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...
CVE-2026-105786 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...
CVE-2026-105786
The open source note-taking application Joplin is vulnerable to an unauthenticated account takeover in versions prior to 3.7.13 . The root cause lies in packages/server/src/models/ApplicationModel.ts, which accepts a caller-chosen application authorization identifier, and the public endpoint pack...
[SECURITY] [DSA 6544-1] sabnzbdplus security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...
CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...
CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...
Debian dsa-6544 : sabnzbdplus - security update
The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6544 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz...
CVE-2026-103495
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs...
CVE-2026-103495
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs...
CVE-2026-103495
Versions of JetBrains YouTrack prior to 2026.2.19422 are vulnerable to a missing authorisation flaw. This security weakness allows for the unauthorized reloading of translation catalogs . The CVSS 3.1 score is 4.3 (Medium) , with a network attack vector and low complexity. Exploitation details an...