Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Code execution via Git VCS roots in JetBrains TeamCity (CVE-2026-65907)
JetBrains TeamCity contains a vulnerability that allows code execution through Git VCS roots. Exploitation of this issue could allow an attacker to execute arbitrary code within the TeamCity environment.
Fixed in 2026.1.2; 2025.11.6
Arbitrary code execution in JetBrains GoLand Go Modules integration (CVE-2026-64802)
JetBrains GoLand before version 2026.2 is vulnerable to arbitrary code execution via the Go Modules integration. The vulnerability can be triggered before a user grants project trust, meaning malicious code could exec...
Fixed in 2026.2
Arbitrary code execution in JetBrains WebStorm via linter configuration (CVE-2026-64807)
JetBrains WebStorm before version 2026.2 contains a vulnerability that allows arbitrary code execution via a project-supplied linter configuration. An attacker could exploit this by providing a malicious linter config...
Fixed in 2026.2
Arbitrary code execution in JetBrains PhpStorm before project trust (CVE-2026-64808)
JetBrains PhpStorm contains a vulnerability that allows arbitrary code execution to occur before a user has granted project trust via project tooling. This flaw could enable malicious code embedded in a project to exe...
Fixed in PhpStorm 2026.2
Arbitrary code execution in JetBrains IntelliJ IDEA via dev container configuration (CVE-2026-64811)
JetBrains IntelliJ IDEA contains a vulnerability that allows arbitrary code execution through development container configuration before the user has granted project trust. An attacker who can supply a malicious proje...
Fixed in 2026.2
Arbitrary code execution in JetBrains PhpStorm before project trust (CVE-2026-64809)
A vulnerability in JetBrains PhpStorm allows arbitrary code execution before a user has granted project trust, triggered via the configured interpreter. This bypasses the project trust security boundary, potentially a...
Fixed in 2026.2
Unauthorized input injection in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64812)
JetBrains IntelliJ IDEA contains a vulnerability that allows unauthorized input injection during a Remote Development session. An attacker capable of exploiting this flaw could inject arbitrary input into the remote s...
Fixed in 2026.2
Unauthorized file access in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64814)
JetBrains IntelliJ IDEA before version 2026.2 contains a vulnerability that allows unauthorized file access during a Remote Development session. An attacker exploiting this flaw could access files without proper autho...
Fixed in 2026.2
Unauthorized settings modification in JetBrains IntelliJ IDEA Remote Development (CVE-2026-64813)
JetBrains IntelliJ IDEA contains a vulnerability that allows unauthorized modification of settings within a Remote Development session. This could permit an attacker with access to the remote session to alter IDE or p...
Fixed in 2026.2
Arbitrary code injection in JetBrains IntelliJ IDEA via UI Designer form files (CVE-2026-64815)
JetBrains IntelliJ IDEA before version 2026.2 is affected by a vulnerability that allows arbitrary code injection through UI Designer form files. An attacker able to supply a malicious form file could achieve arbitrar...
Fixed in 2026.2
Stored XSS to RCE via incomplete HTML escaping in SiYuan Attribute View (CVE-2026-65605)
SiYuan's Attribute View (database) template column renders cell values as HTML using text/template without auto-escaping, applying EscapeHTML only when HasUnclosedHtmlTag returns true. Because that check treats self-c...
Fixed in v3.7.2
XSS to remote code execution in SiYuan Desktop via protocol handler (CVE-2026-65606)
SiYuan Desktop fails to escape the `icon` parameter from `siyuan://plugins/<name>` links before inserting it into the tab header via `innerHTML` in `app/src/layout/Tab.ts`. An attacker can inject an `<img onerror=...>...
Fixed in v3.7.2
Path traversal in SiYuan /export/temp/ short-circuit branch (CVE-2026-65607)
SiYuan's serveExport handler contains a short-circuit branch for /export/temp/ requests that joins the raw percent-decoded request path with util.TempDir and serves files without the IsSubPath or IsSensitivePath check...
Fixed in v3.7.2
Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)
A missing validation check in `FlexDirectory::dynamicDataField()` allows the method to resolve blueprint `data-*@:` directives by calling `call_user_func_array()` on attacker-influenced input, verifying only that the ...
Fixed in 2.0.9
Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)
The Grav API Plugin's ConfigController fails to restrict the `plugins/api` configuration scope to the `api.super` privilege, allowing authenticated users holding only `api.config.write` to modify the API plugin's own ...
Fixed in 1.0.10
Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)
The Grav API Plugin fails to properly sanitize the `slug` field in the `PagesController::move()` method, stripping only leading period characters via `ltrim()` while leaving `/` and `..` path segments unfiltered. An a...
Fixed in 1.0.10
Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)
InvitationsController::create() in the Grav API Plugin applies super-admin flag stripping to the `access` field but performs no equivalent authority check on the `groups` field, accepting it verbatim from the request ...
Fixed in 1.0.10
Broken access control in WordPress WP Booking System plugin (CVE-2026-57367)
The WP Booking System WordPress plugin contains a broken access control vulnerability exploitable by subscriber-level users. This flaw allows lower-privileged authenticated users to perform actions or access resources...
Fixed in 5.12.8.1
Path prefix check bypass allows sibling directory escape in ViewComponent (CVE-2026-44837)
The system test entrypoint in ViewComponent canonicalizes a user-supplied file path with `File.realpath` and then validates it using `String#start_with?` against the temp directory path. Because sibling directories ca...
Fixed in 4.9.0
Denial of service via mod_fastcgi in IBM HTTP Server (CVE-2026-8852)
IBM HTTP Server 8.5 and 9.0 is vulnerable to denial of service through the optional mod_fastcgi module due to a reachable assertion (CWE-617). Exploitation of this vulnerability can result in loss of availability of t...
Fixed in Fix Pack 9.0.5.29 or later; Fix Pack 8.5.5.30 or later