Permalink CVE-2026-16028

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.13/source/lib/Protocol/HTTP2…
• https://github.com/vlet/p5-Protocol-HTTP2/commit/27a488a34d74fd16f123e5e6186d4f… patch
• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.14/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/09/07/2

---

Protocol-HTTP2

• <1.14

Permalink CVE-2026-75046

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18112

Permalink CVE-2026-75045

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2025.3.156085, 2026.1.13913, 2026.2.18112

Permalink CVE-2026-86493

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-75048

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18068

Permalink CVE-2026-75044

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2025.3.156085, 2026.1.13914, 2026.2.18095

Permalink CVE-2026-86488

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86484

4.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86495

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18687

Permalink CVE-2026-86487

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86479

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18788, 2026.1.14055, 2025.3.161254

Permalink CVE-2026-86491

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86486

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86483

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86496

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18769

Permalink CVE-2026-86490

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86482

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86497

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18769

Permalink CVE-2026-86485

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86481

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86492

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86494

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86489

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-84256

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  7 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  • gnomeExtensions.openvpn3-indicator
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-84256 vendor-advisory

---

OpenVPN

• =<2.6.22
• =<2.7.6

Permalink CVE-2026-84226

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  7 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  • gnomeExtensions.openvpn3-indicator
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-84226 vendor-advisory

---

OpenVPN

• =<2.6.22
• =<2.7.6

Permalink CVE-2026-84732

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  7 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  • gnomeExtensions.openvpn3-indicator
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-84732 vendor-advisory

---

OpenVPN

• =<2.6.22
• =<2.7.6

Permalink CVE-2026-86227

1.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 9 hours ago
• @LeSuisse ignored
  6 packages

  • python313Packages.valkey
  • python314Packages.valkey
  • python313Packages.libvalkey
  • python314Packages.libvalkey
  • python313Packages.django-valkey
  • python314Packages.django-valkey
  1 day, 5 hours ago
• @LeSuisse ignored reference https://g… 1 day, 5 hours ago
• @LeSuisse accepted 1 day, 5 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds

• VDB-399380 | valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds technical-descriptionvdb-entry
• VDB-399380 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-86227 | CVE Analysis and Report third-party-advisory
• Submit #897659 | Valkey Project Valkey 9.1.0 Out-of-Bounds Read third-party-advisory
• https://github.com/valkey-io/valkey/issues/4222 issue-tracking
• https://github.com/valkey-io/valkey/pull/4229 issue-trackingpatch
• https://github.com/user-attachments/files/30195539/RDB.zip exploit
• https://github.com/valkey-io/valkey/commit/4691888e7fab3df128f0bde5750c9fde2ae5… patch

Ignored references (1)

• https://github.com/valkey-io/valkey/ product

---

valkey

• ==9.1.0
• ==9.0.1
• ==9.0.2
• ==9.0.0
• ==9.1.1
• ==9.0.3
• ==9.0.5
• ==9.0.4

Permalink CVE-2026-86219

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 9 hours ago
• @LeSuisse ignored
  2 packages

  • perlPackages.AuthenSASLSASLprep
  • perl5Packages.AuthenSASLSASLprep
  1 day, 5 hours ago
• @LeSuisse accepted 1 day, 5 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

• https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/P…
• https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/P…
• https://datatracker.ietf.org/doc/html/rfc2831#section-2.1.2
• https://github.com/perl-authen-sasl/perl-authen-sasl/commit/9433736703061284292… patch
• https://metacpan.org/release/EHUELS/Authen-SASL-2.2100/changes release-notes
• https://www.cve.org/CVERecord?id=CVE-2025-40918 related

---

Authen-SASL

• <2.2100

Permalink CVE-2026-86191

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 14 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 9 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored
  3 maintainers

  • @TomaSajt
  • @mtul0729
  • @L-Trump
  1 day, 14 hours ago maintainer.ignore
• @LeSuisse published on GitHub 1 day, 14 hours ago

SiYuan before v3.8.2 Private Attribute View Key Enumeration

• GitHub Security Advisory (GHSA-j4qq-w6qx-6839) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.8.2 Private Attribute View Key Enumeration third-party-advisory

---

siyuan

• <3.8.2
• ==3.8.2

Permalink CVE-2026-86197

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 14 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 9 hours ago
• @LeSuisse ignored
  19 packages

  • haskellPackages.gravatar
  • gravit
  • antigravity
  • antigravity-cli
  • antigravity-fhs
  • antigravity-ide
  • antigravity-ide-fhs
  • stardust-xr-gravity
  • kdePackages.libgravatar
  • bulwark-plugins.gravatar
  • gnomeExtensions.gravatar
  • python313Packages.libgravatar
  • python314Packages.libgravatar
  • python314Packages.flask-gravatar
  • python313Packages.django-gravatar2
  • python313Packages.flask-gravatar
  • python314Packages.django-gravatar2
  • perlPackages.MojoliciousPluginGravatar
  • perl5Packages.MojoliciousPluginGravatar
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 1 day, 14 hours ago

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

• GitHub Security Advisory (GHSA-8hgv-xc77-jmcr) vendor-advisory
• VulnCheck Advisory: Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox third-party-advisory

---

grav

• <2.0.20
• ==2.0.20

Permalink CVE-2026-86175

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 14 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 9 hours ago
• @LeSuisse ignored
  63 packages

  • netbox2netshot
  • pkgsRocm.netbox
  • pkgsRocm.netbox_4_4
  • netboxPlugins.netbox-bgp
  • netboxPlugins.netbox-dns
  • netboxPlugins.netbox-lists
  • python313Packages.pynetbox
  • python314Packages.pynetbox
  • netboxPlugins.netbox-qrcode
  • netboxPlugins.netbox-routing
  • netboxPlugins.netbox-secrets
  • python313Packages.netbox-bgp
  • python314Packages.netbox-bgp
  • python314Packages.netbox-dns
  • netboxPlugins.netbox-contract
  • netboxPlugins.netbox-security
  • netboxPlugins.netbox-documents
  • netboxPlugins.netbox-inventory
  • netboxPlugins.netbox-lifecycle
  • netboxPlugins.netbox-data-flows
  • python314Packages.netbox-qrcode
  • netboxPlugins.netbox-attachments
  • python313Packages.netbox-routing
  • python314Packages.netbox-routing
  • netboxPlugins.netbox-contextmenus
  • terraform-providers.e-breuninger_netbox
  • python313Packages.netbox-dns
  • python313Packages.netbox-qrcode
  • netboxPlugins.netbox-reorder-rack
  • python313Packages.netbox-contract
  • netboxPlugins.netbox-config-backup
  • netboxPlugins.netbox-napalm-plugin
  • python313Packages.netbox-documents
  • python314Packages.netbox-documents
  • netboxPlugins.netbox-custom-objects
  • netboxPlugins.netbox-topology-views
  • pkgsRocm.python3Packages.netbox-bgp
  • python313Packages.netbox-attachments
  • netboxPlugins.netbox-floorplan-plugin
  • python313Packages.netbox-contextmenus
  • python313Packages.netbox-reorder-rack
  • python314Packages.netbox-contextmenus
  • python314Packages.netbox-reorder-rack
  • pkgsRocm.python3Packages.netbox-qrcode
  • python313Packages.netbox-napalm-plugin
  • pkgsRocm.python3Packages.netbox-routing
  • python313Packages.netbox-topology-views
  • pkgsRocm.python3Packages.netbox-contract
  • netboxPlugins.netbox-plugin-prometheus-sd
  • pkgsRocm.python3Packages.netbox-documents
  • python313Packages.netbox-floorplan-plugin
  • pkgsRocm.python3Packages.netbox-attachments
  • pkgsRocm.python3Packages.netbox-reorder-rack
  • pkgsRocm.python3Packages.netbox-napalm-plugin
  • python313Packages.netbox-plugin-prometheus-sd
  • python314Packages.netbox-plugin-prometheus-sd
  • netboxPlugins.netbox-interface-synchronization
  • pkgsRocm.python3Packages.netbox-topology-views
  • pkgsRocm.python3Packages.netbox-floorplan-plugin
  • python313Packages.netbox-interface-synchronization
  • python314Packages.netbox-interface-synchronization
  • pkgsRocm.python3Packages.netbox-plugin-prometheus-sd
  • pkgsRocm.python3Packages.netbox-interface-synchronization
  1 day, 14 hours ago
• @LeSuisse restored package pkgsRocm.netbox_4_4 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 14 hours ago
• @LeSuisse published on GitHub 1 day, 14 hours ago

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

• Researcher Advisory third-party-advisoryexploit
• DataSourceSerializer Meta.fields technical-description
• DataSourceType GraphQL fields technical-description
• GitBackend sensitive_parameters technical-description
• GitHub Issue #12625 issue-tracking
• https://github.com/netbox-community/netbox product
• VulnCheck Advisory: NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs third-party-advisory

---

netbox

• =<4.7.0

Permalink CVE-2026-86178

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 14 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 9 hours ago
• @LeSuisse accepted 1 day, 14 hours ago
• @LeSuisse published on GitHub 1 day, 14 hours ago

Pixelfed through 0.12.9 Unauthorized Story Access via API

• Researcher Advisory third-party-advisoryexploit
• StoryComposeController react technical-description
• StoryComposeController comment technical-description
• Story react and comment routes technical-description
• https://github.com/pixelfed/pixelfed product
• VulnCheck Advisory: Pixelfed through 0.12.9 Unauthorized Story Access via API third-party-advisory

---

pixelfed

• =<0.12.9

Permalink CVE-2026-86118

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 14 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 9 hours ago
• @LeSuisse accepted 1 day, 14 hours ago
• @LeSuisse published on GitHub 1 day, 14 hours ago

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

• GitHub Security Advisory (GHSA-453r-pgfw-h3pq) vendor-advisory
• ServeStartScan without an admin check technical-description
• /startScan registered on the plain auth chain technical-description
• gonic v0.22.0 Release Notes release-notes
• https://github.com/sentriz/gonic product
• VulnCheck Advisory: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint third-party-advisory

---

gonic

• <0.22.0

Needs a backport.