Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

You must be logged in to use the 'userTag' filter.
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

Export CSV
CVE-2026-86486

Blank Secret Leaves YouTrack VCS Webhook Handler Open

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86485

IP Spoofing via HTTP Headers Allows Forged Bitbucket Webhooks in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86484

Stored XSS via AngularJS Template Injection in JetBrains YouTrack Assignee Names

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86483

Stored XSS via Custom Field on Agile Board Cards in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86481

Signed URL Reuse Exposes Restricted Project Icons

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86480

Unauthenticated Service Registration Grants Superuser Privileges in JetBrains Hub

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Hub
CVE-2026-86479

Authorization Bypass via IDOR in JetBrains YouTrack REST APIs

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86478

Unauthenticated Account Takeover via Self‑Asserted Email Authentication in YouTrack Helpdesk

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86206

Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

CVSS 4.0 · 6.9 Medium EPSS 1.1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-83534

PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-81806

WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
John Darrel Wordpress
Products
Hide My Wp Ghost Wordpress
CVE-2026-81798

WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Wordpress
Products
Easy Appointments Wordpress
CVE-2026-76963

Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Netweaver And Abap Platform
CVE-2026-48888

WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Automattic Wordpress
Products
Woocommerce Wordpress
CVE-2026-19634

PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-19633

PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Miniorange.com
Products
Miniorange Oauth Client Extension For Joomla