Security Vulnerabilities
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
CVSS Score
7.8
EPSS Score
0.001
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
CVSS Score
4.3
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVSS Score
4.3
EPSS Score
0.007
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
CVSS Score
4.3
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
CVSS Score
5.3
EPSS Score
0.003
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
CVSS Score
5.4
EPSS Score
0.002
Published
2026-09-30
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
CVSS Score
8.8
EPSS Score
0.004
Published
2026-09-30
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
CVSS Score
8.8
EPSS Score
0.005
Published
2026-09-30
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
CVSS Score
10.0
EPSS Score
0.005
Published
2026-09-30
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-09-30