JetBrains TeamCity < 2025.11.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow CVE-2026-28194 - In JetBrains TeamCity before...

CVE-2026-27509

Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 EDU do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programmingactuator/request handled by actuatormanager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publi...

CVE-2026-27509

Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 EDU do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programmingactuator/request handled by actuatormanager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publi...

The vulnerability of the raid_message() function in the drivers/md/dm-raid.c module of the Linux kernel support for multiple device types (RAID and LVM) allows a hacker to cause a service failure.

The vulnerability of the raidmessage function in the drivers/md/dm-raid.c module of the Linux support for multiple device types RAID and LVM is related to the occurrence of mutual locking. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the destroy() function in the drivers/md/dm-cache-target.c file of the Linux operating system’s device driver framework for multiple devices (such as RAID and LVM) allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the destroy function in the drivers/md/dm-cache-target.c file of the Linux kernel driver for multiple device drivers such as RAID and LVM is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-27498

n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration...

n8n has Arbitrary Command Execution via File Write and Git Operations

Impact An authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary she...

CVE-2025-10010

The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk. Multiple...

GHSA-XFVG-8V67-J7WP TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload

I. Summary A Stored Cross-Site Scripting XSS vulnerability exists in the file upload module of TypiCMS. The application allows users with file upload permissions to upload SVG files. While there is a MIME type validation, the content of the SVG file is not sanitized. An attacker can upload a...

TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload

I. Summary A Stored Cross-Site Scripting XSS vulnerability exists in the file upload module of TypiCMS. The application allows users with file upload permissions to upload SVG files. While there is a MIME type validation, the content of the SVG file is not sanitized. An attacker can upload a...

EUVD-2026-8654

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...

CVE-2026-28196

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...

CVE-2026-28196

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...

CVE-2026-28196

JetBrains TeamCity (before 2025.11.3) is affected by CVE-2026-28196, where disabling versioned settings can leave a credentials config on disk. The root cause is the residual credentials file after the operation, with a CVSS v3.1 base score of 2.3 (LOW) and local attack vector requiring user acce...

CVE-2026-28196

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...

CVE-2026-28196

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...

CVE-2026-26104

A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitiv...

Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse

...

PT-2026-21906

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools developed by the Czech company JetBrains. This tool offers features such as continuous unit testing, code quality analysis, and reporting on build issues. Versions prior to JetBrains TeamCity 2025.11.3...