Export limit exceeded: 420337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420337 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123335 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection | ||||
| CVE-2026-123337 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility | ||||
| CVE-2026-35111 | 2026-11-06 | 4.8 Medium | ||
| HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-35114 | 2026-11-06 | 3.7 Low | ||
| HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-35115 | 2026-11-06 | 3.7 Low | ||
| HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-92080 | 2026-11-06 | 4.3 Medium | ||
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0. | ||||
| CVE-2026-115431 | 2026-11-06 | 7.1 High | ||
| Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6. | ||||
| CVE-2026-115952 | 2026-11-06 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3. | ||||
| CVE-2026-123301 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 8.2 High |
| In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible | ||||
| CVE-2026-123276 | 1 Jetbrains | 1 Clion | 2026-11-06 | 7.8 High |
| In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile | ||||
| CVE-2026-123277 | 1 Jetbrains | 1 Clion | 2026-11-06 | 5 Medium |
| In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux | ||||
| CVE-2026-123278 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 6.7 Medium |
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint | ||||
| CVE-2026-123281 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 7.5 High |
| In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker | ||||
| CVE-2026-123294 | 1 Jetbrains | 1 Hub | 2026-11-06 | 9.6 Critical |
| In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow | ||||
| CVE-2026-123297 | 1 Jetbrains | 1 Hub | 2026-11-06 | 6.8 Medium |
| In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow | ||||
| CVE-2026-123299 | 1 Jetbrains | 1 Hub | 2026-11-06 | 3.1 Low |
| In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible | ||||
| CVE-2026-123300 | 1 Jetbrains | 1 Hub | 2026-11-06 | 2.7 Low |
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings | ||||
| CVE-2026-123308 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 6.3 Medium |
| In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects | ||||
| CVE-2026-123309 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 6.1 Medium |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview | ||||
| CVE-2026-84161 | 1 Ericsson | 1 Codechecker | 2026-11-06 | 4.9 Medium |
| When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced. This gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability. The shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report. | ||||