19324 matches found
EUVD-2026-72521
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...
CVE-2026-86505
JetBrains IntelliJ IDEA prior to 2026.2.2 contains a missing project-trust check that allowed project metadata to be leaked to the JetBrains Marketplace . The vulnerability requires a local attack vector with user interaction, resulting in a low confidentiality impact (CVSS 3.1 score: 3.3 LOW ). ...
CVE-2026-86505
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...
CVE-2026-76560
creationtimestamp| type| source ---|---|--- 2026-09-07 13:55:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jcerdibv6ffze...
CVE-2022-51013
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...
CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...
CVE-2022-51013
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. An authenticated remote attacker can send negative or out-of-range damage values in itemstack NBT data, triggering unhandled exceptions in the Durable class and causi...
CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...
CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...
CVE-2026-86418
MISP (≤2.5.45) exposes organisation metadata (ID, UUID, name) through the dashboard organisation picker endpoint without applying the same visibility restrictions enforced by the normal organisation index. When Security.hide_organisation_index_from_users was enabled, normal enumeration was restri...
EUVD-2026-72362
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: organisation ID; UUID; name. Whe...
CVE-2026-86418 MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...
CVE-2026-86418 MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...
EUVD-2026-72319
Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...
CVE-2026-86342 MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information
Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...
WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability
Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin JetFormBuilder versions 3.6.5.2...
CVE-2026-82755: Use of Cache Containing Sensitive Information
Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
PT-2026-86877
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...
CVE-2026-82757: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...
PT-2026-86925
Use of Cache Containing Sensitive Information vulnerability in ash-project ash authentication oauth2 server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...