Vulnerabilidades

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may…

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information.