33832 matches found
astral-tokio-tar has a PAX Header Desynchronization issue
Impact Versions of astral-tokio-tar prior to 0.6.2 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle...
CVE-2026-48555 Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl method in InteractsWithMedia.php...
CVE-2026-49385
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts...
CVE-2026-49386
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas...
CVE-2026-49385
JetBrains YouTrack is affected by CVE-2026-49385 in versions before 2026.1.13570, due to improper access control that allows low-privileged users to modify service accounts. The exposed component is YouTrack’s service account management, with an underlying cause described as access control failur...
EUVD-2026-33392
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible...
CVE-2026-49383
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible...
EUVD-2026-33391
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible...
CVE-2026-49382
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin...
CVE-2026-49382
CVE-2026-49382 affects JetBrains IntelliJ IDEA prior to 2026.1. The issue allows code execution via template injection in the Copyright plugin. This is the concrete vulnerability described across trusted sources; no exploit details are provided in the connected documents. The core root cause is t...
CVE-2026-49380
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible...
CVE-2026-49380
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible...
CVE-2026-49381
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible...
CVE-2026-49381
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible...
CVE-2026-49381
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible...
EUVD-2026-33387
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names...
CVE-2026-49378
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion...
CVE-2026-49378
JetBrains TeamCity prior to version 2026.1 exposes credentials parameters through parameter autocompletion. Affected product: TeamCity server. Root cause: credential values were surfaced in autocompletion UI, enabling potential disclosure. This entry provides no specific exploit details, affected...