Archive
29 May 2026
Vulnerabilities first published on this day (UTC), newest first.
257 results · Feed
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
-
Medium 6.1
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
-
Medium 4.5
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
-
Low 3.1
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
-
Low 3.4
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
-
Medium 4.3
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
-
Medium 6.5
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
-
Medium 4.3
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
-
Medium 6.1
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
-
Medium 6.5
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
-
High 7.5
In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
-
High 7.6
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
-
High 7.1CVE-2026-49373 EPSS 33%
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
-
High 7.1
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
-
Low 3.4
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
-
High 8.0
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
-
High 8.7
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
-
Medium 4.3
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
-
Medium 5.3
liboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss_commons.c:194)
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification …
-
Medium 5.3
liboqs: XMSS Buffer Overread Bug
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification …
-
Critical 9.1
Authentication Bypass Vulnerability in NI SystemLink Enterprise
There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure. Successful ex…
-
High 8.1
Shopper: Authorization bypass in multiple Livewire admin components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail…
-
Medium 5.9
Shopper: Race condition on Discount.usage_limit allows silent over-redemption
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, …
-
Medium 6.5
Shopper: Missing authorization on Product admin Livewire sub-form components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could…
-
Critical 9.9
Shopper: Authorization bypass and RBAC privilege escalation in team settings
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user c…
-
Medium 6.5
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user withou…
-
Medium 6.9
SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).sen…
-
Critical 9.1
SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName:…
-
Medium 5.7
MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
-
High 7.5CVE-2026-44648 Public exploit
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, st…
-
Critical 9.8
SillyTavern: Authentication Bypass via SSO Header Injection
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User (Authelia) and X-Authentik-…
-
High 8.3
MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials
Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.
-
Medium 6.9
SillyTavern: SSRF vulnerability in the CORS proxy middleware
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, corsProxyMiddleware forwards req.params.url directly into f…
-
Medium 5.4
MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
-
High 8.5CVE-2026-46372 Scanner template
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts atta…
-
Medium 5.4
MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.
-
High 8.3
MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials
The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.
-
Critical 9.3
Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combini…
-
High 8.6
Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataIntercep…