🚨 CVE-2026-103489
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103491
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103492
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103493
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103495
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103496
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103497
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-34189
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-34190
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64946
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64947
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64948
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64949
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64950
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-75786
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-7173
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
* (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page.
* (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.
🎖@cveNotify
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
* (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page.
* (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in Entradium by Crocantickets
INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by C
🚨 CVE-2026-7174
CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
🎖@cveNotify
CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in Entradium by Crocantickets
INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by C
🚨 CVE-2026-7176
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.
🎖@cveNotify
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in Entradium by Crocantickets
INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by C
🚨 CVE-2026-83589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
🎖@cveNotify
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
🎖@cveNotify
Redhat
CVE-2026-83589 - Red Hat Customer Portal
CVE Details App