Remote Code Execution via Structural Search Script Constraints in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing algorithm used for the same password on another authentication path. A party able to read this file, including a local user or a party with access to a configuration backup, could feasibly recover the underlying password through offline computation, compromising the administrative credential across every path that accepts it.

YouTrack SSRF via Stored X‑HTML Injection in PDF Export

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

Missing Authorization Allows Read-Only Users to View Project Settings in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

YouTrack Gantt Chart Improper Access Control Allows Edits by View‑Only Users

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

Authentication after Password Reset via Mailbox Integration in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.

Unauthorized Article Visibility Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

Authorization Bypass Allowing Read‑Only Users to Modify Project Notification Templates

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.

HTML Injection via User‑Agent Header in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.

Apache WSS4J: SAML Sender-Vouches Authentication Bypass

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Cross‑Site Scripting Vulnerability in CAPEC‑63 Before 3.0b63

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS). This issue affects CAPEC-63: before 3.0b63.

External Control of File Name or Path Leading to Directory Traversal in Johnson Controls EasyIO FS32

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.

Insecure Default Initialization Allows Authentication Abuse in EasyIO FS32

: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63.

Cleartext Transmission of Sensitive Information in Johnson Controls EasyIO NEO Enabling Man‑in‑the‑Middle Attacks

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25.

Sensitive Information Exposure via Common Resource Locations in Johnson Controls Easy IO Neo

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63.

Neo Series MVP2 On‑Chip Debug Interface Allows Data Collection from Common Resource Locations

- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63.

ON‑Chip Debug Interface Vulnerability Exposing Common Resource Data

- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63.