106,863 results · Clear filters · Feed
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
-
Medium 6.4
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
-
Medium 6.3
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI sch…
-
Medium 5.5
In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
-
Medium 4.8
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
-
Medium 5.3
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview w…
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown prev…
-
Medium 5.4
In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories …
-
Medium 6.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configuratio…
-
Medium 6.3
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
-
Medium 6.8
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
-
Medium 5.0
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
-
Medium 5.3
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactiv…
-
Medium 4.3
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs noteb…
-
Medium 5.4
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
-
Medium 5.4
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
-
Medium 5.9
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
-
Medium 5.9
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published int…
-
Medium 6.5
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify…
-
Medium 6.3
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injec…
-
Medium 6.8
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
-
Medium 6.7
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
-
Medium 5.0
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session env…
-
Medium 5.3
Session Token Remains Valid After Logout in Multi-Worker Deployments
CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single wo…
-
Medium 5.9
undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not …
-
Medium 5.9
undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin,…
-
Medium 5.9
undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, wh…
-
Medium 5.9
undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSi…
-
Medium 6.5
undici vulnerable to cross-user cache disclosure via same-origin redirect
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final res…
-
Medium 4.3
VOD Infomaniak <= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX Action
The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticat…
-
Medium 6.4
Wp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute
The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attr…
-
Medium 5.3
Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …
-
Medium 4.9
YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied p…
-
Medium 6.5
Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible for authenticated atta…
-
Medium 6.4
WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta
The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and i…
-
Medium 5.3
Vulnerability-Lookup: memory amplification through webhook payload template format specifiers
In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchange…
-
Medium 6.5
Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an actio…
-
Medium 6.4
Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authentica…
-
Medium 6.4
Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possibl…
-
Medium 6.4
UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient …