CVE-2026-86501

JetBrains IntelliJ IDEA versions prior to 2026.2.2 allow terminal command input to be written to the application's idea.log file. This is a low-severity local information disclosure (CVSS 3.1 score 2.8 , vector AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) requiring local access, low privileges, and user ...

CVE-2026-86500

In JetBrains YouTrack versions prior to 2026.1.14047 , a missing escalation check allowed a user with project update permissions to grant themselves Project Admin rights, effectively elevating their access beyond the intended permission level. The underlying cause is the absence of a proper check...

CVE-2026-86498

JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 is affected by an authorization flaw: PUT requests on link sub-resources allowed modification of linked entities without requiring the update permission. The issue carries a CVSS v3.1 score of 7.7 (HIGH) with a changed scope , indi...

CVE-2026-86499

JetBrains YouTrack before version 2026.1.14047 contained an information disclosure flaw in its predefined search fields , which leaked all group names to any user regardless of their visibility permissions. The vulnerability is rated CVSS 4.3 (Medium) with a network attack vector, low complexity,...

CVE-2026-86495

JetBrains YouTrack versions before 2026.2.18687 are affected by missing permission checks that allow a low-privileged user to create knowledge base articles in projects they cannot otherwise access. This results in a HIGH integrity impact (CVSS 3.1 score 6.5 MEDIUM , vector AV:N/AC:L/PR:L/UI:N/S:...

CVE-2026-86497

JetBrains YouTrack versions before 2026.2.18769 contained a vulnerability in the mailbox configuration flow. Changing a mailbox host did not require re-authentication, allowing a project administrator to exfiltrate stored mailbox credentials . The CVSS 3.1 score is 6.8 (MEDIUM) with a network att...

CVE-2026-86496

JetBrains YouTrack versions before 2026.2.18769 are affected by a missing access control on Helpdesk authorized reporters , which exposed reporter email addresses . The vulnerability requires a low-privilege authenticated network user (no user interaction) and results in a low confidentiality imp...

CVE-2026-86492

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in a shared token cache that permits cross-tenant theft of GitHub App installation tokens . An attacker with low privileges over the network (no user interaction required) can steal tokens belonging to other tenants, ...

CVE-2026-86493

JetBrains YouTrack versions before 2026.2.18634 contained improper permission checks that allowed read-only users to create and modify whiteboard cards . This represents an authorization bypass with an integrity impact — a user granted only read access could alter content without being permitted ...

CVE-2026-86494

In JetBrains YouTrack versions prior to 2026.2.18634 , cloning a whiteboard allowed an attacker with low privileges to make unauthorized changes to links on issues they could not otherwise access. The vulnerability is rated CVSS 7.7 (High) with changed scope and high integrity impact , requiring ...

CVE-2026-86489

JetBrains YouTrack before version 2026.2.18634 contains an IDOR (Insecure Direct Object Reference) vulnerability in the user profile API , allowing an attacker with low-level privileges to disclose private issues and starred folders across organizations via the network. The CVSS 3.1 score is 6.5 ...

CVE-2026-86491

JetBrains YouTrack versions prior to 2026.2.18634 were affected by a stored XSS vulnerability exploitable through project and organization icon uploads . An attacker with high privileges (e.g., an authenticated user with project or organization admin rights) could inject malicious scripts that ex...

CVE-2026-86490

JetBrains YouTrack versions before 2026.2.18634 are affected by improper permission checks in the app import endpoint , allowing an authenticated attacker to overwrite bundled applications. The vulnerability yields a CVSS 3.1 score of 6.5 (Medium) with high integrity impact , exploitable over the...

CVE-2026-86487

In JetBrains YouTrack versions before 2026.2.18634 , a crafted WebSocket message allowed read-only whiteboard users to modify canvas content. The flaw is an integrity issue: users who should have had read-only access could alter whiteboard drawings. The CVSS 3.1 score is 3.1 (LOW) , reflecting a ...

CVE-2026-86488

JetBrains YouTrack prior to version 2026.2.18634 contains an Insecure Direct Object Reference (iDOR) vulnerability in the watchRules and issueListConfig endpoints, allowing a low-privileged authenticated user to access private saved searches belonging to other users. The CNA-assigned CVSS 3.1 sco...

CVE-2026-86484

JetBrains YouTrack before version 2026.2.18634 is vulnerable to a stored cross-site scripting (XSS) flaw caused by AngularJS template injection in assignee names. An authenticated user (low privileges) can craft a malicious assignee name that, when viewed by another user, executes arbitrary scrip...

CVE-2026-86486

In JetBrains YouTrack versions before 2026.2.18634 , the generic VCS webhook handler had a fail-open condition when its secret was blank, meaning the handler would not properly validate incoming webhook requests if no secret had been configured. This results in a low integrity impact with a high ...

CVE-2026-86485

JetBrains YouTrack prior to version 2026.2.18634 is vulnerable to IP spoofing via HTTP headers , which allowed an attacker to forge Bitbucket webhook events. The underlying cause is the lack of proper source validation on incoming webhook requests, permitting a local actor with user interaction t...

CVE-2026-86482

JetBrains YouTrack prior to version 2026.2.18634 is affected by a privilege escalation vulnerability caused by unchecked group membership changes , allowing a low-privileged user to escalate their permissions. The flaw is exploitable over the network with low attack complexity and no user interac...

CVE-2026-86483

JetBrains YouTrack versions before 2026.2.18634 contained a stored XSS vulnerability exploitable through a custom field on Agile board cards . The CVSS 3.1 score is 5.4 (MEDIUM) , with a changed scope and low impact on both confidentiality and integrity, requiring low privileges and user interact...

CVE-2026-86480

JetBrains Hub prior to version 2026.2.52442 is affected by a privilege escalation vulnerability. An unauthenticated attacker over the network could register a trusted service and subsequently gain superuser privileges , resulting in full compromise of confidentiality, integrity, and availability ...

CVE-2026-86479

JetBrains YouTrack versions prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 are affected by a missing authorisation vulnerability that allows unauthorised access to restricted REST API resources via an IDOR (Insecure Direct Object Reference) flaw. An attacker with low-level privileges (e.g...

CVE-2026-86481

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in which signed URL reuse allowed disclosure of restricted project icons . The underlying cause is the reuse of signed URLs, enabling an authenticated low-privilege user to access project icon resources that should re...

CVE-2026-86478

JetBrains YouTrack is vulnerable to an improper authentication flaw in the YouTrack Helpdesk component prior to versions 2025.3.161254 and 2026.1.14042 . The vulnerability allows an unauthenticated attacker to perform account takeover by supplying a self-asserted email address, effectively bypass...

CVE-2026-80125

Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) are affected by an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote network access could potentially exploit this flaw to gain unauthorized access , re...

CVE-2026-80167

CVE-2026-80167 affects Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 . The vulnerability is a Use of Hard-coded Cryptographic Key , allowing a low-privileged attacker with local access to achieve information disclosure (C...

CVE-2026-80126

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain an Improper Locking vulnerability. A low-privileged attacker with remote network access could potentially exploit this flaw to obtain filesystem access on the applianc...

CVE-2026-79975

Dell Secure Connect Gateway (SCG) 5.0 Appliance (versions prior to 5.36.00.16 ) and Application (versions prior to 5.36.00.00 ) contains an Improper Certificate Validation vulnerability. A low-privileged attacker with local access could exploit it to achieve server-side request forgery (SSRF) , r...

CVE-2026-80058

Dell Secure Connect Gateway (SCG) 5.0 contains a Cleartext Storage of Sensitive Information vulnerability in both the Appliance (versions prior to 5.36.00.16 ) and Application (versions prior to 5.36.00.00 ). A low-privileged attacker with local access could exploit this flaw to expose sensitive ...

CVE-2026-86469

A race condition flaw in GLib2 's g_file_replace() function allows a local attacker with write access to the destination directory to redirect file writes to an arbitrary file. When the ".goutputstream-XXXXXX" temporary file creation fails, the library unlinks and recreates the destination withou...

CVE-2026-80127

Dell SCG 5.0 (Secure Connect Gateway) is affected by an OS Command Injection vulnerability in both the Appliance and Application editions. Affected versions are Appliance prior to 5.36.00.16 and Application prior to 5.36.00.00 . A high-privileged attacker with remote access could exploit the impr...

CVE-2026-79642

Dell Secure Connect Gateway (SCG) 5.0 — both Appliance and Application editions — is affected by an Improper Certificate Validation vulnerability. The flaw allows an unauthenticated remote attacker to gain unauthorized access , with low impact on confidentiality, integrity, and availability. The ...

CVE-2026-79943

Dell Secure Connect Gateway (SCG) 5.0 (Appliance and Application) contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote network access could exploit this to achieve a protection mechanism bypass , resulting in low impact to both c...

CVE-2026-79691

CVE-2026-79691 affects Dell Secure Connect Gateway (SCG) 5.0 , specifically the Appliance (versions prior to 5.36.00.16 ) and Application (versions prior to 5.36.00.00 ). The vulnerability is an Improper Certificate Validation flaw that allows an unauthenticated attacker with network access to by...

CVE-2026-79643

Dell Secure Connect Gateway (SCG) 5.0 — both Appliance and Application editions — is affected by a Use of Incorrect Operator vulnerability. An unauthenticated attacker with remote network access could exploit this flaw (no user interaction required) to gain unauthorized access , with low impact o...

CVE-2026-80054

Dell Secure Connect Gateway (SCG) 5.0 Appliance (before 5.36.00.16) and Application (before 5.36.00.00) are affected by an Incorrect Permission Assignment for Critical Resource flaw. A low-privileged attacker with local access can exploit this to gain unauthorized access , resulting in a high con...

CVE-2026-86321

A server-side request forgery (SSRF) vulnerability affects java-json-tools jackson-coreutils 2.0 , specifically in the JsonLoader.fromURL function within JsonLoader.java (URL Validation component). A remote attacker with no authentication can trigger the flaw, resulting in a low availability impa...

CVE-2026-86319

A resource consumption vulnerability in the json-patch Java library (versions up to 1.13 ) affects the JsonPatch.apply function in the Patch Operation Handler component. An attacker can trigger it remotely with no authentication or user interaction, resulting in a denial-of-service condition. The...

CVE-2026-86318

A stack-based buffer overflow vulnerability exists in the java-json-tools json-patch library (versions up to 1.13 ), specifically in the JsonMergePatch.fromJson function within JsonMergePatchDeserializer.java . The flaw can be exploited remotely with no authentication required and low complexity,...

CVE-2026-78488

Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) contain an OS Command Injection vulnerability caused by improper neutralization of special elements in OS commands. A low-privileged remote attacker could exploit this to achieve command ex...

CVE-2026-7861

A deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows remote attackers to achieve code injection . The affected versions are up to and including 07092026 . The vulnerability is rated CVSS 9.8 (Critical) with a network ...

CVE-2026-80056

Dell Secure Connect Gateway (SCG) 5.0 is affected by an Insertion of Sensitive Information into Log File vulnerability. A low-privileged attacker with local access could potentially exploit this flaw, leading to information exposure (high confidentiality impact; no integrity or availability impac...

CVE-2026-6377

CVE-2026-6377 is a Path Traversal vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management), affecting versions 6.8.9 through 07092026 . The flaw is described as an Improper Limitation of a Pathname to a Restricted Directory , allowing an unauthenticated remote att...

CVE-2026-86317

ggml-org llama.cpp versions up to 0.4.0 contain a vulnerability in the RPC Server component, specifically the rpc_server::deserialize_tensor function in ggml/src/ggml-rpc/ggml-rpc.cpp. Manipulation of the ne argument triggers a reachable assertion , leading to a denial-of-service condition. The a...

CVE-2026-19843

CVE-2026-19843 is a command injection flaw in 389-ds-base . The Cockpit 389 Console LDAP editor embeds an LDAP distinguished name (DN) into a shell command without proper escaping. An LDAP user with delegated privileges can craft a malicious DN with shell metacharacters; when a Cockpit administra...

CVE-2026-18922

389 Directory Server (389-ds-base) is affected by a privilege escalation flaw in SASL PLAIN authentication . A stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind can be installed on a connection after a subsequent successful bind. An attacker can issue a SASL PLAIN...

CVE-2026-18453

389 Directory Server (389-ds-base) contains a missing NULL pointer check in the paged results handling of op_shared_search. An unauthenticated remote attacker can exploit this by sending a crafted sequence of search requests using the USE_ONE_BACKEND control , causing the LDAP server to crash and...

CVE-2026-18355

A heap buffer overflow was found in the SASL I/O layer of 389 Directory Server (389-ds-base) . In sasl_io_start_packet(), the wrapped-record length is validated only against an upper bound; a small wire length (0, 1, or 2) causes an unsigned subtraction underflow in sasl_io_read_packet(), request...

CVE-2026-80057

Dell Secure Connect Gateway (SCG) 5.0 contains a Use of Hard-coded Cryptographic Key vulnerability in Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00. A low-privileged attacker with local access can exploit this to achieve information disclosure (high confident...

CVE-2026-79644

Dell Secure Connect Gateway (SCG) 5.0 contains an Improper Certificate Validation vulnerability affecting the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00). An unauthenticated attacker with remote network access could potentially exploit this flaw to gain...