Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 397 total.
Unauthorized settings modification in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64813)
JetBrains IntelliJ IDEA contains a vulnerability that allows unauthorized modification of settings within a Remote Development session. This could permit an attacker with access to the remote session to alter IDE or p...
Fixed in 2026.2
Arbitrary code injection in JetBrains IntelliJ IDEA via UI Designer form files (CVE-2026-64815)
JetBrains IntelliJ IDEA before version 2026.2 is affected by a vulnerability that allows arbitrary code injection through UI Designer form files. An attacker able to supply a malicious form file could achieve arbitrar...
Fixed in 2026.2
Stored XSS to RCE via incomplete HTML escaping in SiYuan Attribute View (CVE-2026-65605)
SiYuan's Attribute View (database) template column renders cell values as HTML using text/template without auto-escaping, applying EscapeHTML only when HasUnclosedHtmlTag returns true. Because that check treats self-c...
Fixed in v3.7.2
XSS to remote code execution in SiYuan Desktop via protocol handler (CVE-2026-65606)
SiYuan Desktop fails to escape the `icon` parameter from `siyuan://plugins/<name>` links before inserting it into the tab header via `innerHTML` in `app/src/layout/Tab.ts`. An attacker can inject an `<img onerror=...>...
Fixed in v3.7.2
Denial of service via configuration write access in IBM HTTP Server (CVE-2026-8856)
IBM HTTP Server 8.5 and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration. This vulnerability is classified as uncontrolled resource consu...
Fixed in 9.0.5.29; 8.5.5.30
Remote code execution and denial of service in IBM HTTP Server (CVE-2026-8855)
IBM HTTP Server 8.5 and 9.0 is vulnerable to remote code execution and denial of service when configured with TLS mutual authentication (client authentication). The vulnerability is classified as improper control of c...
Fixed in Fix Pack 9.0.5.29; Fix Pack 8.5.5.30
Code injection via 'path' parameter in Customer Support Ticket System & Helpdesk for WordPress (CVE-2026-15011)
The Customer Support Ticket System & Helpdesk WordPress plugin allows unauthenticated attackers to invoke arbitrary parameterless PHP functions via the 'path' parameter due to dynamic function invocation on an attacke...
Fixed in 6.0.6
Unauthenticated arbitrary file upload in GoDAM WordPress plugin (CVE-2026-14282)
The GoDAM plugin for WordPress contains insufficient file type validation in the `save_video_file()` function, which trusts the attacker-supplied multipart Content-Type header and moves uploads into a web-served direc...
Fixed in 2.0.0
Remote code execution in fastjson 1.2.68-1.2.83 (CVE-2026-16723)
A remote code execution vulnerability exists in fastjson 1.2.68 through 1.2.83, exploitable under the library's stock default configuration with no AutoType enablement and no classpath gadget required. The only deploy...
Fixed in fastjson 1.2.84
Authentication bypass in Check Point SmartConsole login process (CVE-2026-16232)
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative p...
Fixed in Jumbo Hotfix Accumulator for R82.10 starting from Take 36; Jumbo Hotfix Accumulator for R82 starting from Take 118; Jumbo Hotfix Accumulator for R81.20 starting from Take 158
Authentication bypass and privilege escalation in Check Point Security Management (CVE-2026-62144)
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management Server allows an unauthenticated remote attacker to execute arbitrary administrative commands on the Manag...
Fixed in Jumbo Hotfix Accumulator for R82.10 starting from Take 36; Jumbo Hotfix Accumulator for R82 starting from Take 118; Jumbo Hotfix Accumulator for R81.20 starting from Take 158
Heap memory disclosure via type confusion in HTML::Gumbo for Perl (CVE-2025-15646)
HTML::Gumbo before version 0.19 fails to handle the `<template>` HTML element in its `walk_tree` function, treating it as a text node and causing `strlen()` to over-read a heap buffer. Callers using `parse()` with `fo...
Fixed in 0.19
Open redirect and DOM-based XSS in Unblu Spark (CVE-2026-8152)
Unblu Spark contains an open redirect vulnerability via the redirectOnFailure parameter that can be escalated to DOM-based cross-site scripting (XSS). When deployed with com.unblu.identifier.siteEmbeddedSetup=true, th...
Fixed in 8.36.1-hotfix.0
Hardcoded Credentials in Apache Solr BasicAuth Setup (CVE-2026-44825)
Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 contain hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable). A remote attacker can gain full administrative access to the cluster us...
Fixed in 9.11.0; 10.1.0
Eval injection in Net::DNS via EDNS EXTENDED ERROR option (CVE-2026-64193)
Net::DNS versions through 1.55 for Perl contain an eval injection vulnerability in the parsing of the EXTRA-TEXT field of EDNS EXTENDED-ERROR options (RFC 8914). The `_decompose` method tokenises raw bytes and passes ...
Fixed in 1.56
Command injection via log_file_name parameter in stata-mcp (CVE-2026-47708)
The `log_file_name` parameter in the `stata_do` API and CLI of stata-mcp is interpolated directly into a Stata command string without sanitization, allowing an attacker to break out of the string context and inject ar...
Fixed in 1.17.3
Authorization bypass in Gitea pull request update API endpoint (CVE-2026-58443)
Gitea fails to re-apply a token's public-only restriction when the pull request update endpoint (`POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`) operates on a private head repository. The publi...
Fixed in 1.27.0
Privilege escalation via Personal Access Token scope bypass in Gitea (CVE-2026-56654)
Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) can be accessed using an existing token formatted as `Authorization: Basic <token>:x-oauth-basic`. The Basic auth handler sets...
Fixed in 1.27.0
Remember-Me token theft session persistence in Gitea (CVE-2026-56750)
Gitea's Remember-Me authentication fails to invalidate an attacker's session when a stolen token is detected as compromised via hash mismatch. When the legitimate user's original token triggers a hash mismatch, Gitea ...
Fixed in 1.27.0
Command injection in Tenable Security Center audit file upload (CVE-2026-64879)
Tenable Security Center does not properly sanitize filenames supplied during audit file upload before using them in system command execution. An attacker can inject shell metacharacters into a supplied filename to ach...
Fixed in SC202607.1