CVE Database

Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts …

Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native …

Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a …

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in …

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently …

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied …

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed …

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file …

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction …

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the …

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control …

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external …

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: …

When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python …

In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates

In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion

In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL

In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account

In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is …

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to …

The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, …

Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who …

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can …

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content …

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can …

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages …