| CVE-2026-123316 | MEDIUM | 5.5 | In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs… | 2026-11-06 |
| CVE-2026-123317 | HIGH | 8.1 | In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies… | 2026-11-06 |
| CVE-2026-123318 | MEDIUM | 4.8 | In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine… | 2026-11-06 |
| CVE-2026-123319 | LOW | 3.7 | In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie inj… | 2026-11-06 |
| CVE-2026-123320 | LOW | 3.1 | In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious… | 2026-11-06 |
| CVE-2026-123321 | HIGH | 7.8 | In JetBrains WebStorm before 2026.3,
2026.2.3 code execution via Grunt and Gulp task loading was possible in … | 2026-11-06 |
| CVE-2026-123322 | MEDIUM | 6.3 | In JetBrains WebStorm before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Angul… | 2026-11-06 |
| CVE-2026-123323 | HIGH | 8.4 | In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 improper URL validation in the app wi… | 2026-11-06 |
| CVE-2026-123324 | HIGH | 7.7 | In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possib… | 2026-11-06 |
| CVE-2026-123325 | HIGH | 7.1 | In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 inclusion of untrusted remote code wa… | 2026-11-06 |
| CVE-2026-123326 | HIGH | 7.1 | In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow scr… | 2026-11-06 |
| CVE-2026-123327 | HIGH | 7.5 | In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure… | 2026-11-06 |
| CVE-2026-123328 | MEDIUM | 6.4 | In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab… | 2026-11-06 |
| CVE-2026-123329 | MEDIUM | 5.4 | In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of … | 2026-11-06 |
| CVE-2026-123330 | MEDIUM | 5.4 | In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change … | 2026-11-06 |
| CVE-2026-123331 | MEDIUM | 5.4 | In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles… | 2026-11-06 |
| CVE-2026-123332 | MEDIUM | 4.7 | In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting se… | 2026-11-06 |
| CVE-2026-123333 | LOW | 3.8 | In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects bet… | 2026-11-06 |
| CVE-2026-123334 | LOW | 3.8 | In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations ow… | 2026-11-06 |
| CVE-2026-123335 | LOW | 3.5 | In JetBrains YouTrack before 2026.2.19562,
2026.1.14137,
2025.3.169041 missing authorization allowed attach… | 2026-11-06 |
| CVE-2026-123336 | LOW | 3.1 | In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread … | 2026-11-06 |
| CVE-2026-123337 | LOW | 3.1 | In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility… | 2026-11-06 |
| CVE-2026-66293 | NA | N/A | XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content:… | 2026-11-06 |
| CVE-2026-66294 | NA | N/A | XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping… | 2026-11-06 |
| CVE-2026-66295 | NA | N/A | Saxy's XML encoder writes the target and the content of a processing instruction into the output document verb… | 2026-11-06 |
| CVE-2026-84155 | NA | N/A | CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more th… | 2026-11-06 |
| CVE-2026-84161 | MEDIUM | 4.9 | When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a p… | 2026-11-06 |
| CVE-2026-84164 | NA | N/A | The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html gen… | 2026-11-06 |
| CVE-2025-66621 | NA | N/A | Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloa… | 2026-11-06 |
| CVE-2026-103479 | HIGH | 7.6 | The Pubjet | پابجت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl… | 2026-11-06 |
| CVE-2026-103908 | MEDIUM | 5.4 | The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execut… | 2026-11-06 |
| CVE-2026-104010 | HIGH | 7.5 | The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is v… | 2026-11-06 |
| CVE-2026-107622 | CRITICAL | 9.8 | The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including… | 2026-11-06 |
| CVE-2026-107658 | MEDIUM | 5.4 | The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and bu… | 2026-11-06 |
| CVE-2026-114630 | CRITICAL | 9.1 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file d… | 2026-11-06 |
| CVE-2026-116545 | MEDIUM | 6.4 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for Wor… | 2026-11-06 |
| CVE-2026-116551 | MEDIUM | 6.4 | The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' … | 2026-11-06 |
| CVE-2026-116624 | HIGH | 8.8 | The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,… | 2026-11-06 |
| CVE-2026-119178 | MEDIUM | 5.4 | The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' param… | 2026-11-06 |
| CVE-2026-119211 | MEDIUM | 4.9 | The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_p… | 2026-11-06 |
| CVE-2026-120035 | MEDIUM | 5.4 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for Wo… | 2026-11-06 |
| CVE-2026-123655 | HIGH | 7.5 | A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remo… | 2026-11-06 |
| CVE-2026-49939 | NA | N/A | In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP prot… | 2026-11-06 |
| CVE-2026-74756 | NA | N/A | Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper auth… | 2026-11-06 |
| CVE-2026-76168 | NA | N/A | In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file path… | 2026-11-06 |
| CVE-2026-76171 | NA | N/A | In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the… | 2026-11-06 |
| CVE-2026-85108 | NA | N/A | Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allow… | 2026-11-06 |
| CVE-2026-85111 | NA | N/A | Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allow… | 2026-11-06 |
| CVE-2026-89101 | MEDIUM | 6.5 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPres… | 2026-11-06 |
| CVE-2026-92895 | HIGH | 8.1 | The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and inc… | 2026-11-06 |