| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session |
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account |
| In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content |
| In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection |
| In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token |
| In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports |
| Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.
See CVE-2026-85108 in Apache James MIME4J library. |
| The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover. |
| Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults. |
| A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content. |
| In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 xXE attack was possible via an XML response to an HTTP Client request |
| In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs |
| In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies |
| In JetBrains WebStorm before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader |
| In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles |
| In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project |
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link |
| In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files |
| In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid |
