In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations

Private Saved Searches Exposed via watchRules and issueListConfig endpoints

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches

Read‑Only Users Can Modify Canvas via Crafted WebSocket Message in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content

Blank Secret Leaves YouTrack VCS Webhook Handler Open

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

IP Spoofing via HTTP Headers Allows Forged Bitbucket Webhooks in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

Stored XSS via AngularJS Template Injection in JetBrains YouTrack Assignee Names

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

Stored XSS via Custom Field on Agile Board Cards in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

Signed URL Reuse Exposes Restricted Project Icons

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

Unauthenticated Service Registration Grants Superuser Privileges in JetBrains Hub

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

Authorization Bypass via IDOR in JetBrains YouTrack REST APIs

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

Unauthenticated Account Takeover via Self‑Asserted Email Authentication in YouTrack Helpdesk

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.

WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions

WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.

WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.

WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.