CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-100275 | MEDIUM | 4.8 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible |
| CVE-2026-100274 | MEDIUM | 6.5 | 0.8% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template |
| CVE-2026-100273 | CRITICAL | 9.8 | 0.3% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution |
| CVE-2026-100272 | MEDIUM | 4.9 | 0.3% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Adm... |
| CVE-2026-100271 | LOW | 2.7 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to acce... |
| CVE-2026-100270 | LOW | 2.7 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials v... |
| CVE-2026-100269 | MEDIUM | 4.3 | 0.3% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed |
| CVE-2026-100268 | LOW | 2.7 | 0.3% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notificatio... |
| CVE-2026-100267 | MEDIUM | 5.9 | 0.4% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters |
| CVE-2026-100266 | MEDIUM | 6.5 | 0.2% | Sep 30, 2026 | In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the... |
| CVE-2026-100265 | MEDIUM | 6.5 | 0.1% | Sep 30, 2026 | In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation |
| CVE-2026-100264 | LOW | 2.7 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
| CVE-2026-100263 | MEDIUM | 6.1 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible |
| CVE-2026-100262 | HIGH | 7.1 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite... |
| CVE-2026-100261 | MEDIUM | 5.4 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission |
| CVE-2026-100260 | MEDIUM | 5.3 | 0.3% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset |
| CVE-2026-100259 | MEDIUM | 4.3 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only a... |
| CVE-2026-100258 | MEDIUM | 4.3 | 0.6% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
| CVE-2026-100257 | MEDIUM | 4.3 | 0.2% | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export |
| CVE-2026-100256 | HIGH | 7.8 | 0.1% | Sep 30, 2026 | In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projec... |
| CVE-2026-100255 | CRITICAL | 9.8 | 0.3% | Sep 30, 2026 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password rese... |
| CVE-2026-100254 | HIGH | 8.8 | 0.5% | Sep 30, 2026 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers... |
| CVE-2026-100253 | HIGH | 8.8 | 0.4% | Sep 30, 2026 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the... |
| CVE-2026-97259 | MEDIUM | 5.3 | — | Sep 30, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Ex... |
| CVE-2026-94545 | MEDIUM | 5.3 | — | Sep 30, 2026 | Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does ... |