JetBrains YouTrack < 2025.3.170763 / 2026.1.x < 2026.1.14150 / 2026.2.x < 2026.2.19656 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.170763, or 2026.1.x prior to 2026.1.14150, or 2026.2.x prior to 2026.2.19656. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusio...

CVE-2026-123323

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation...

EUVD-2026-118087

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation...

CVE-2026-123323

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation...

CVE-2026-123323

JetBrains YouTrack versions before 2025.3.170763 , 2026.1.14150 , and 2026.2.19656 are vulnerable to a flaw in the app widget host . Due to improper URL validation , malicious applications can bypass user confirmation to send REST requests . This vulnerability carries a CVSS 3.1 score of 8.4 (Hig...

CVE-2026-123323

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation...

CVE-2026-123323: JetBrains YouTrack: In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host…

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation...

CVE-2026-19594

Insufficient input sanitization in Snowflake Python API "snowflake.core" versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded ".." identifier path segments, and HTTP parameter pollution CWE-141 via unencoded...

CVE-2026-19594: Improper Limitation of a Pathname to a Restricted Directory

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

CVE-2024-58368

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...

CVE-2026-8438

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the getrestroute function and missing output escaping in the columndefault method of the...

CVE-2026-8438 All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the getrestroute function and missing output escaping in the columndefault method of the...

CVE-2026-8438

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the getrestroute function and missing output escaping in the columndefault method of the...

CVE-2026-0504

CVE-2026-0504 affects SAP Identity Management REST interface. The issue arises from insufficient input handling that allows an authenticated administrator to send crafted REST requests processed by JNDI operations without proper input neutralization. According to multiple sources, this can lead t...

EUVD-2016-2401

Malware in sbrugna...

EUVD-2024-47588

Malicious code in bioql PyPI...

Privilege Escalation

Doccano Auto Labeling Pipeline vulnerable to Privilege Escalation. The vulnerability is due to improper validation of REST requests, which allows a remote attacker to escalate privileges via a crafted request...

CVE-2024-6504

Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the conso...

CVE-2024-6504

Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the conso...

CVE-2024-6504: Allocation of Resources Without Limits or Throttling

Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the conso...