🚨 CVE-2026-47745
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
🎖@cveNotify
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
🎖@cveNotify
GitHub
fix(security): authorization bypass and discount race in cart/checkout by mckenziearts · Pull Request #511 · shopperlabs/shopper
Summary
Hardens the admin and checkout against unauthorized mutations and fixes the long-standing discount race condition reported in #510.
Authorization bypasses
Order Detail / Shipments: 8 Filam...
Hardens the admin and checkout against unauthorized mutations and fixes the long-standing discount race condition reported in #510.
Authorization bypasses
Order Detail / Shipments: 8 Filam...
🚨 CVE-2026-49366
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
🎖@cveNotify
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49367
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
🎖@cveNotify
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49368
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49369
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49370
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49371
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49372
In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49373
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
🎖@cveNotify
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49374
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
🎖@cveNotify
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49375
In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page
🎖@cveNotify
In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49376
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
🎖@cveNotify
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49377
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
🎖@cveNotify
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49378
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
🎖@cveNotify
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49379
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
🎖@cveNotify
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49380
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49381
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
🎖@cveNotify
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49383
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
🎖@cveNotify
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49384
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
🎖@cveNotify
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49385
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-49386
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
🎖@cveNotify
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.