Security Vulnerabilities
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVSS Score
4.3
EPSS Score
0.007
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
CVSS Score
4.3
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
CVSS Score
5.3
EPSS Score
0.003
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
CVSS Score
5.4
EPSS Score
0.002
Published
2026-09-30
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
CVSS Score
8.8
EPSS Score
0.004
Published
2026-09-30
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
CVSS Score
8.8
EPSS Score
0.005
Published
2026-09-30
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
CVSS Score
10.0
EPSS Score
0.005
Published
2026-09-30
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-09-30
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
CVSS Score
9.1
EPSS Score
0.003
Published
2026-09-30
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-09-30