Threat database

CVE-2026-106134 is a Cross-Site Scripting (XSS) vulnerability in the Menu component of Progress Software's KendoReact library. It affects versions 1.3.0 through 16.1.0. A low-privileged attacker who can influence the Menu item data can inject unsafe URLs that execute arbitrary JavaScript when a user selects the malicious menu item. This vulnerability has been fixed in version 16.2.0.

CVE-2026-106135 is a Cross-Site Scripting (XSS) vulnerability in the Chat component of Progress Software's Kendo UI for Angular versions prior to 25.3.0. It allows a low-privileged attacker who can supply chat messages to execute arbitrary JavaScript in another user's browser by exploiting an unsafe URL in an openUrl quick action. The vulnerability is fixed in version 25.3.0.

A vulnerability in the Symfony Serializer component's ObjectNormalizer allows untrusted input containing property paths to modify nested object attributes improperly, bypassing #[Ignore] metadata protections in certain Symfony versions before fixed releases. This can lead to unauthorized modification of object properties, including invoking public methods with attacker-controlled values. The issue affects versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11. The vulnerability is medium severity with a CVSS 4.0 score of 6.9. The fix restricts property path acceptance to only declared attributes in class metadata, preventing unauthorized traversal and modification.

Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.

CVE-2026-118515 is a high-severity vulnerability in the Symfony Serializer component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. It allows an attacker to craft a request that causes the application to treat arbitrary files on the server as uploaded files without actual upload, potentially exposing or moving sensitive files. This occurs because the DataUriNormalizer only handles specific types, and subclasses like UploadedFile can be instantiated with attacker-controlled paths, bypassing normal upload checks.

CVE-2026-123859 is a SQL injection vulnerability in the Snowflake Connector for Python and its Universal Core variant. When identifier escaping is disabled via a non-default configuration, the write_pandas() function fails to escape DataFrame column names before embedding them in SQL statements. This allows crafted column names to inject additional SQL commands, potentially enabling unauthorized reading, modification, or deletion of data accessible to the Snowflake role used by the application. Exploitation requires attacker-controlled column names passed to this functionality. Fixed versions 4.8.1 and 5.2.0 are available and users must upgrade manually.

In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server

CVE-2026-123855 is a high-severity OS command injection vulnerability in JetBrains Toolbox App versions before 3.6.1. The flaw allows command injection via enterprise configuration URLs. It was fixed in version 3.6.1.

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

CVE-2026-123853 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via project-controlled JVM options of the build process. The flaw is due to inclusion of functionality from an untrusted control sphere (CWE-829).

CVE-2026-123852 is a high-severity vulnerability in JetBrains Junie GitHub Action versions before 1.8.0. It involves incorrect authorization (CWE-863) that allows code execution with workflow credentials via fork updates. The issue is fixed in version 1.8.0.

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

CVE-2026-123849 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in untrusted projects via the Terraform File Watchers feature. The flaw is classified under CWE-829, which involves inclusion of functionality from an untrusted control sphere. This vulnerability has been fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates

In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion

In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation