🚨 CVE-2026-47744
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.
🎖@cveNotify
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.
🎖@cveNotify
GitHub
Authorization bypass and RBAC privilege escalation in team settings
## Impact
Two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system:
- `Settings/Team/Index` had no `mount()` authorization. An...
Two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system:
- `Settings/Team/Index` had no `mount()` authorization. An...
🚨 CVE-2026-47745
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
🎖@cveNotify
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
🎖@cveNotify
GitHub
fix(security): authorization bypass and discount race in cart/checkout by mckenziearts · Pull Request #511 · shopperlabs/shopper
Summary
Hardens the admin and checkout against unauthorized mutations and fixes the long-standing discount race condition reported in #510.
Authorization bypasses
Order Detail / Shipments: 8 Filam...
Hardens the admin and checkout against unauthorized mutations and fixes the long-standing discount race condition reported in #510.
Authorization bypasses
Order Detail / Shipments: 8 Filam...
🚨 CVE-2026-49366
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
🎖@cveNotify
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49367
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
🎖@cveNotify
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49368
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49369
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49370
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49371
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49372
In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49373
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
🎖@cveNotify
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49374
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
🎖@cveNotify
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49375
In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page
🎖@cveNotify
In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49376
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
🎖@cveNotify
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49377
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
🎖@cveNotify
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49378
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
🎖@cveNotify
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49379
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
🎖@cveNotify
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49380
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49381
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49383
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
🎖@cveNotify
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49384
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
🎖@cveNotify
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49385
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.