| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118. |
| Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the renderTemplateString method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29889. |
| Memory Corruption when processing firmware update data in Download mode due to a missing bounds check. |
| This CVE ID is a duplicate of CVE-2026-80335 (VULN-002 dl_download_midst) and has been rejected. |
| The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.
Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state. |
| Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations. |
| Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions. |
| In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension |
| In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 xXE attack was possible via an XML response to an HTTP Client request |
| In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook |
| In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint |
| In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files |
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link |
| In JetBrains CLion before 2026.3,
2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux |
| In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion |
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings |
| In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs |
| In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility |
