90901 matches found
CVE-2026-86309: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/prosearchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...
CVE-2026-86439: Improper Limitation of a Pathname to a Restricted Directory
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...
CVE-2026-86539: Server-Side Request Forgery (SSRF)
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...
CVE-2025-52657: Allocation of Resources Without Limits or Throttling
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability...
CVE-2026-86491: Improper Neutralization of Input During Web Page Generation
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-86542: Improper Limitation of a Pathname to a Restricted Directory
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...
CVE-2026-86500: Incorrect Privilege Assignment
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...
CVE-2026-86488: Authorization Bypass Through User-Controlled Key
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches...
CVE-2026-86478: Authentication Bypass by Spoofing
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...
CVE-2026-77697: Improper Privilege Management
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...
CVE-2026-84256: Improper Neutralization of Special Elements used in an OS Command
An argument parsing issue in OpenVPN 2.1rc10 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject...
CVE-2026-86543: Missing Authentication for Critical Function
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...
CVE-2026-86544: Incorrect Authorization
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent...
CVE-2026-77698: Improper Privilege Management
Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...
CVE-2026-7861: Deserialization of Untrusted Data
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: before 8.0.3...
CVE-2026-86538: Improper Limitation of a Pathname to a Restricted Directory
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...
CVE-2026-86486: Missing Authentication for Critical Function
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...
CVE-2026-85640: Improper Privilege Management
Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component...
CVE-2026-86540: Improper Neutralization of Special Elements used in an OS Command
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...