CVE-2026-123853

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process...

CVE-2026-123854

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module...

CVE-2026-123852

In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates...

CVE-2026-123849

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers...

CVE-2026-123841

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-123838

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file...

CVE-2026-123832

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database...

CVE-2026-123831

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings...

CVE-2026-123835

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition...

CVE-2026-104657

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at ...

CVE-2026-118762

A flaw was found in Monkeytype. Its continuous integration CI workflow improperly executes untrusted code from external pull requests with elevated write permissions. A remote attacker can submit a pull request containing malicious code that executes within the build environment, allowing them to...

CVE-2026-121953

A flaw was found in FreeRDP. A use-after-free vulnerability exists in the client's Remote Desktop Protocol Graphics RDPGFX dynamic virtual channel handling. A malicious RDP server can open a second dynamic virtual channel that reuses an already registered channel name with a different ChannelId,...

CVE-2024-3806

CVE-2024-3806 Porto = 7.1.0 - Unauthenticated Local File Inclusion via portoajaxposts Description The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'portoajaxposts' function. This makes it possible for unauthenticated attackers...

CVE-2024-11392

CVE-2024-11392 Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability High-level overview and effects of the vulnerability: The vulnerability allows an attacker to execute arbitrary code on the host machine by supplying a malicious configuratio...

CVE-2020-10567

POC-CVE-2020-10567 RCE poc - RESPONSIVE filemanager v.9.14.0. not Main branche ⚠️ Github project : https://github.com/trippo/ResponsiveFilemanager Requirements: Nothing is required, this exploit is unauthenticated. The Responsive Filemanager application is a web-based file management tool used to...

CVE-2026-104657

The Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows lacks integrity verification for downloaded components. An attacker can influence a release component to execute attacker-controlled code when a user runs the skill. Specifically on macOS, the skill stages package...

CVE-2026-104657 Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at ...

EUVD-2026-118358

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at ...

synaptic-sentinel

SYNAPTIC Sentinel The vibe-coding security sentinel. An Apache-2.0 agentic security toolkit for projects where most of the code is written by AI. Five deterministic scouts catch the syntactic problems; a Brain Layer BYOK Anthropic decides what really matters and how to fix it — all inside the IDE...

CVE-2026-90436

UNSUPPORTED WHEN ASSIGNED Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP carries a element, Axis loads the named class and, if a String element is also present, instantiates it through its String constructor before checki...