Export limit exceeded: 421198 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421198 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421198 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123326 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.1 High |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension | ||||
| CVE-2026-123309 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 6.1 Medium |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview | ||||
| CVE-2026-123292 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 2.7 Low |
| In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid | ||||
| CVE-2026-123336 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion | ||||
| CVE-2026-123327 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.5 High |
| In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions | ||||
| CVE-2026-123290 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.3 Medium |
| In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint | ||||
| CVE-2026-123291 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 4.3 Medium |
| In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook | ||||
| CVE-2026-123300 | 1 Jetbrains | 1 Hub | 2026-11-06 | 2.7 Low |
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings | ||||
| CVE-2026-123316 | 2026-11-06 | 5.5 Medium | ||
| In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs | ||||
| CVE-2026-123288 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.4 Medium |
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link | ||||
| CVE-2026-123289 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.4 Medium |
| In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files | ||||
| CVE-2026-123299 | 1 Jetbrains | 1 Hub | 2026-11-06 | 3.1 Low |
| In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible | ||||
| CVE-2026-123277 | 1 Jetbrains | 1 Clion | 2026-11-06 | 5 Medium |
| In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux | ||||
| CVE-2026-123314 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 3.1 Low |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request | ||||
| CVE-2026-123337 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility | ||||
| CVE-2026-121818 | 1 About Time Technologies | 1 Herowatch Go | 2026-11-06 | 7.8 High |
| Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code. | ||||
| CVE-2026-94459 | 1 Iris | 1 Irispowerscan | 2026-11-06 | N/A |
| IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration. | ||||
| CVE-2026-94460 | 1 Iris | 1 Irispowerscan | 2026-11-06 | N/A |
| IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality. | ||||
| CVE-2026-95649 | 1 Iris | 1 Irispowerscan | 2026-11-06 | N/A |
| IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan. | ||||
| CVE-2026-111036 | 1 Coupa | 2 Coupa S Total Spend Management Platform, Coupa Total Spend Management Platform | 2026-11-06 | N/A |
| Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services. | ||||