Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,860

CVE-2026-123285

JVM Options Injection Enables Command Execution in JetBrains Datalore Database Tasks

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-123286

Improper Authorization Enables Retrieval of Notebook Owner's File Storage Session Token

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-123287

Unauthorized Download of Private Notebook Files via Published Interactive Reports in JetBrains Datalore

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-123288

Stored Cross‑Site Scripting via Vega Editor Link in JetBrains Datalore

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-127209

Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123289

Improper Authorization in JetBrains Datalore Allowing File Modification by Notebook Viewers

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-123290

Hidden Notebook Code Exposure via Public Endpoint

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-123291

Improper owner validation in JetBrains Datalore allows cross‑workspace data reading

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-119882

Windows Remote Desktop Services Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-119885

Windows Storport Miniport Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-17134

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17137

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17139

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect