Статьи Support
🚨 CVE-2026-123299
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
🚨 CVE-2026-123300
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
🚨 CVE-2026-123302
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4,
2026.1.5.1,
2025.3.6.2 code execution was possible in untrusted projects via script engine discovery
🚨 CVE-2026-123304
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
🚨 CVE-2026-123305
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
🚨 CVE-2026-123308
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
🚨 CVE-2026-123309
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
🚨 CVE-2026-123311
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible
🚨 CVE-2026-123314
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
🚨 CVE-2026-123316
In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
🚨 CVE-2026-123324
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
🚨 CVE-2026-123325
In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
🚨 CVE-2026-123336
In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
🚨 CVE-2026-123337
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
🚨 CVE-2026-107658
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for...
🚨 CVE-2026-116545
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to, and including...
🚨 CVE-2026-116551
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
🚨 CVE-2026-119178
The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
🚨 CVE-2026-119211
The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
🚨 CVE-2026-120035
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to...
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.