CVEs

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse…

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference…

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid…

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without…

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions.

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.