CVE-2026-123326

Authorization flaw in JetBrains YouTrack scripts debugger enables script disclosure and suspension

In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-123316

Exposure of Sensitive Environment Variables in Session Event Logs

In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123336

Attachment Size Limit Bypass via AI Assistant Thread Conversion in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-123299

Information Disclosure via User Search Queries in JetBrains Hub

In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Hub

CVE-2026-123337

Privilege Escalation via Unchecked Visibility Changes in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-123324

Information Disclosure via Shared Mailbox Message History in JetBrains YouTrack Before 2026.2.19562

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-123300

Read‑Only Users Can Modify Authentication Module Group Mappings Without Proper Authorization

In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Hub

CVE-2026-123277

Local user can read debug session environment

In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Clion

CVE-2026-121818

About Time Technologies｜Herowatch Go - Security Misconfiguration

Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

About Time Technologies

Products

Herowatch Go

CVE-2026-120422

Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution

Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Sogou

Products

Sogou Input Method

CVE-2026-121936

easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cosin2077

Products

Easyvoice

CVE-2026-121938

langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Moyangzhan

Products

Langchain4j-aideepin

CVE-2026-121941

libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex

libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Munt

Products

Libmt32emu

CVE-2026-121945

CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Coopcycle

Products

Coopcycle-web

CVE-2026-121620

CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Coopcycle

Products

Coopcycle-web

CVE-2026-122120

Unauthorized File Write Allowing Remote Code Execution in Yealink Plug‑in Softwares

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Yealink

Products

Plug-in Softwares

CVE-2026-122148

MeetingBoard: MeetingBoard: Unauthorized screenshot capture via front-end validation bypass

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Yealink

Products

Meetingboard Pro

CVE-2026-97705

Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Moleculerjs

Products

Moleculer

CVE-2026-121968

Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Quozl

Products

Netrek-client-cow

CVE-2026-121969

netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage

netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Quozl

Products

Netrek-client-cow