| CVE-2026-103985 | HIGH | 7.1 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_a… | 2026-11-06 |
| CVE-2026-104656 | HIGH | 7.3 | Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier… | 2026-11-06 |
| CVE-2026-104657 | HIGH | 7.5 | Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and … | 2026-11-06 |
| CVE-2026-106127 | MEDIUM | 4.1 | Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versi… | 2026-11-06 |
| CVE-2026-106128 | MEDIUM | 4.1 | Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through… | 2026-11-06 |
| CVE-2026-106134 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReac… | 2026-11-06 |
| CVE-2026-106135 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Softw… | 2026-11-06 |
| CVE-2026-106136 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Softwar… | 2026-11-06 |
| CVE-2026-106141 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo… | 2026-11-06 |
| CVE-2026-106142 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoRe… | 2026-11-06 |
| CVE-2026-106143 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI … | 2026-11-06 |
| CVE-2026-106144 | MEDIUM | 4.1 | Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-… | 2026-11-06 |
| CVE-2026-118515 | NA | N/A | The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, an… | 2026-11-06 |
| CVE-2026-122053 | NA | N/A | The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.… | 2026-11-06 |
| CVE-2026-122193 | CRITICAL | 9.9 | OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before … | 2026-11-06 |
| CVE-2026-123831 | CRITICAL | 9.6 | In JetBrains CLion before 2026.2,
2026.1.4 code execution was possible in Safe Mode via Meson project setting… | 2026-11-06 |
| CVE-2026-123832 | CRITICAL | 9.6 | In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database… | 2026-11-06 |
| CVE-2026-123833 | LOW | 3.6 | In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects… | 2026-11-06 |
| CVE-2026-123834 | HIGH | 7.5 | In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspac… | 2026-11-06 |
| CVE-2026-123835 | MEDIUM | 5.9 | In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init scri… | 2026-11-06 |
| CVE-2026-123836 | HIGH | 8.8 | In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git b… | 2026-11-06 |
| CVE-2026-123837 | HIGH | 7.8 | In JetBrains IntelliJ IDEA before 2026.3,
2026.2.1 command injection was possible in untrusted projects via T… | 2026-11-06 |
| CVE-2026-123838 | HIGH | 7.8 | In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file… | 2026-11-06 |
| CVE-2026-123839 | MEDIUM | 4.7 | In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remo… | 2026-11-06 |
| CVE-2026-123840 | MEDIUM | 4.7 | In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs… | 2026-11-06 |
| CVE-2026-123841 | HIGH | 7.8 | In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings arch… | 2026-11-06 |
| CVE-2026-123842 | HIGH | 7.1 | In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin… | 2026-11-06 |
| CVE-2026-123843 | LOW | 3.3 | In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration… | 2026-11-06 |
| CVE-2026-123844 | MEDIUM | 5.3 | In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories… | 2026-11-06 |
| CVE-2026-123845 | LOW | 3.3 | In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted p… | 2026-11-06 |
| CVE-2026-123846 | MEDIUM | 4.3 | In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validati… | 2026-11-06 |
| CVE-2026-123847 | MEDIUM | 5.3 | In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal com… | 2026-11-06 |
| CVE-2026-123848 | HIGH | 7.4 | In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates… | 2026-11-06 |
| CVE-2026-123849 | HIGH | 7.0 | In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform F… | 2026-11-06 |
| CVE-2026-123850 | LOW | 3.5 | In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration dir… | 2026-11-06 |
| CVE-2026-123851 | MEDIUM | 5.4 | In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded c… | 2026-11-06 |
| CVE-2026-123852 | HIGH | 7.4 | In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork u… | 2026-11-06 |
| CVE-2026-123853 | HIGH | 7.8 | In JetBrains IntelliJ IDEA before 2026.3,
2026.2.2 code execution was possible in Safe Mode via project-contr… | 2026-11-06 |
| CVE-2026-123854 | MEDIUM | 5.5 | In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook wid… | 2026-11-06 |
| CVE-2026-123855 | HIGH | 7.5 | In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs… | 2026-11-06 |
| CVE-2026-123856 | MEDIUM | 6.5 | In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Devel… | 2026-11-06 |
| CVE-2026-123857 | MEDIUM | 4.3 | In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection… | 2026-11-06 |
| CVE-2026-123858 | MEDIUM | 4.4 | In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from … | 2026-11-06 |
| CVE-2026-123859 | HIGH | 8.1 | When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading func… | 2026-11-06 |
| CVE-2026-123962 | HIGH | 8.4 | In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by… | 2026-11-06 |
| CVE-2026-49951 | MEDIUM | 6.3 | RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers… | 2026-11-06 |
| CVE-2026-62850 | MEDIUM | 5.3 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php mainte… | 2026-11-06 |
| CVE-2026-62851 | MEDIUM | 4.3 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in Co… | 2026-11-06 |
| CVE-2026-62852 | MEDIUM | 6.5 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only g… | 2026-11-06 |
| CVE-2026-62854 | HIGH | 7.6 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signa… | 2026-11-06 |