| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network. |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension |
| A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service. |
| The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via the WordPress core REST endpoint POST /wp-json/wp/v2/users/me, which bypasses the plugin's own wpum_sanitize_text sanitizer applied on its front-end account form, making the save-time sanitization ineffective as a mitigation. |
| In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation |
| In JetBrains YouTrack before 2026.2.19562,
2026.1.14137,
2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection |
| In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility |
| Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6. |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3. |
| In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible |
| In JetBrains CLion before 2026.3,
2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile |
| In JetBrains CLion before 2026.3,
2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux |
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint |
| In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker |
| In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow |
| In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow |
| In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible |
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings |
| In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 stored XSS was possible on the built-in web server via Markdown preview |
