| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports |
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session |
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account |
| In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content |
| In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection |
| In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token |
| In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports |
| Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.
See CVE-2026-85108 in Apache James MIME4J library. |
| The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover. |
| Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults. |
| In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 xXE attack was possible via an XML response to an HTTP Client request |
| In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs |
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link |
| In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files |
| In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting |
| In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint |
| In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.
This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.
Users are recommended to upgrade to version 3.9.1 which fixes this issue. |
| Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.
Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience. |
