CVE-2026-97237: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...

CVE-2026-96836: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Parsi Date = 6.3 versions...

CVE-2026-96349: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in SiteSkite = 2.1.8 versions...

CVE-2026-27371: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPFunnels = 3.13.1 versions...

CVE-2026-102395: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Easy Google Maps = 1.14.6 versions...

CVE-2026-78229: Improper Neutralization of Special Elements used in an OS Command

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

CVE-2026-102136: Improper Neutralization of CRLF Sequences

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

CVE-2026-100276: Incorrect Authorization

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...

CVE-2026-100255: Improper Validation of Unsafe Equivalence in Input

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...

CVE-2026-102143: Missing Authentication for Critical Function

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...

CVE-2026-94082: Improper Neutralization of Special Elements used in an SQL Command

Author SQL Injection in Quiz Cat = 3.1.1 versions...

CVE-2026-102145: Improper Neutralization of CRLF Sequences

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

CVE-2026-102119: Improper Limitation of a Pathname to a Restricted Directory

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...

CVE-2026-97289: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...

CVE-2026-81310: Improper Link Resolution Before File Access

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance...

CVE-2026-97292: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...

CVE-2026-102138: Server-Side Request Forgery (SSRF)

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...

CVE-2026-100257: Server-Side Request Forgery (SSRF)

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...

CVE-2026-102110: Missing Authentication for Critical Function

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...

PT-2026-102997

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance...