🚨 CVE-2026-103492
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103493
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103495
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103496
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-103497
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
🎖@cveNotify
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
🎖@cveNotify
JetBrains
Fixed security issues
This page contains information about resolved security issues, including description, severity, assigned CVEs, and the product versions in which they were resolved.
🚨 CVE-2026-34189
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-34190
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64946
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64947
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64948
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64949
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-64950
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-75786
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
🎖@cveNotify
Pandora FMS
Pandora FMS Common Vulnerabilities and Exposures
Common vulnerabilities and exposures is a list of common identifiers of publicly known cybersecurity vulnerabilities.
🚨 CVE-2026-7173
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
* (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page.
* (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.
🎖@cveNotify
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
* (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page.
* (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in Entradium by Crocantickets
INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by C
🚨 CVE-2026-7174
CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
🎖@cveNotify
CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in Entradium by Crocantickets
INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by C
🚨 CVE-2026-7176
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.
🎖@cveNotify
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in Entradium by Crocantickets
INCIBE has coordinated the disclosure of four medium-severity vulnerabilities affecting Entradium by C
🚨 CVE-2026-83589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
🎖@cveNotify
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
🎖@cveNotify
Redhat
CVE-2026-83589 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-92144
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.
🎖@cveNotify
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.
🎖@cveNotify
🚨 CVE-2026-96256
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
🎖@cveNotify
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
🎖@cveNotify
🚨 CVE-2026-96577
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
🎖@cveNotify
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
🎖@cveNotify
Redhat
CVE-2026-96577 - Red Hat Customer Portal
CVE Details App