News & Sicurezza

CVE ID :CVE-2026-86488 Published : Sept. 7, 2026, 5:17 p.m. | 4 hours, 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86490 Published : Sept. 7, 2026, 5:17 p.m. | 4 hours, 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86491 Published : Sept. 7, 2026, 5:17 p.m. | 4 hours, 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads Severity: 3.5 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86482 Published : Sept. 7, 2026, 5:17 p.m. | 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86486 Published : Sept. 7, 2026, 5:17 p.m. | 4 hours, 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86485 Published : Sept. 7, 2026, 5:17 p.m. | 4 hours, 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks Severity: 3.5 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86484 Published : Sept. 7, 2026, 5:17 p.m. | 2 hours, 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS Severity: 4.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86483 Published : Sept. 7, 2026, 5:17 p.m. | 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86487 Published : Sept. 7, 2026, 5:17 p.m. | 4 hours, 12 minutes ago Description :In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86318 Published : Sept. 7, 2026, 3:17 p.m. | 12 minutes ago Description :A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86319 Published : Sept. 7, 2026, 3:17 p.m. | 12 minutes ago Description :A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86317 Published : Sept. 7, 2026, 3:17 p.m. | 12 minutes ago Description :A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be carried out remotely. The reported GitHub issue was closed automatically due to inactivity. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...