Export limit exceeded: 420298 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420298 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420298 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76171 | 2026-11-06 | N/A | ||
| In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue. | ||||
| CVE-2026-49939 | 2026-11-06 | N/A | ||
| In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue. | ||||
| CVE-2025-66621 | 2026-11-06 | N/A | ||
| Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection. | ||||
| CVE-2026-123279 | 2026-11-06 | 9 Critical | ||
| In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators | ||||
| CVE-2026-123280 | 2026-11-06 | 8.1 High | ||
| In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports | ||||
| CVE-2026-123281 | 2026-11-06 | 7.5 High | ||
| In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker | ||||
| CVE-2026-123282 | 2026-11-06 | 7.4 High | ||
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session | ||||
| CVE-2026-123283 | 2026-11-06 | 6.8 Medium | ||
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account | ||||
| CVE-2026-123284 | 2026-11-06 | 6.5 Medium | ||
| In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content | ||||
| CVE-2026-123285 | 2026-11-06 | 6.3 Medium | ||
| In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection | ||||
| CVE-2026-123286 | 2026-11-06 | 5.9 Medium | ||
| In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token | ||||
| CVE-2026-123287 | 2026-11-06 | 5.9 Medium | ||
| In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports | ||||
| CVE-2026-123288 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link | ||||
| CVE-2026-123289 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files | ||||
| CVE-2026-123291 | 2026-11-06 | 4.3 Medium | ||
| In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook | ||||
| CVE-2026-123292 | 2026-11-06 | 2.7 Low | ||
| In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid | ||||
| CVE-2026-123293 | 2026-11-06 | 7.8 High | ||
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting | ||||
| CVE-2026-123295 | 2026-11-06 | 8.1 High | ||
| In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint | ||||
| CVE-2026-123296 | 2026-11-06 | 7.5 High | ||
| In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible | ||||
| CVE-2026-123297 | 2026-11-06 | 6.8 Medium | ||
| In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow | ||||