CVE-2026-123838 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via a UI Designer form file due to inclusion of functionality from an untrusted control sphere (CWE-829). This flaw is fixed in version 2026.3.
CVE-2026-123837 is an OS command injection vulnerability in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.1. The flaw allows command injection via Tomcat run configurations on Windows Subsystem for Linux (WSL) when working with untrusted projects. This vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. A fix is available in version 2026.3.
CVE-2026-123836 is a vulnerability in JetBrains Datalore before version 2026.4 that allows workspace collaborators to obtain the owner's SSH private key via Git backup due to improper link following (CWE-59). This flaw has a high severity with a CVSS score of 8.8. The issue is fixed in version 2026.4.
CVE-2026-123834 is a high-severity vulnerability in JetBrains Datalore before version 2026.4. It involves improper scope validation in database tasks, which allows an attacker to use another workspace's service account. This flaw is categorized as an authorization bypass through a user-controlled key (CWE-639).
CVE-2026-123832 is a critical vulnerability in JetBrains CLion before version 2026.2 that allows code execution in Safe Mode via a JSON compilation database. This flaw involves the inclusion of functionality from an untrusted control sphere, classified under CWE-829. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. A fix is available in version 2026.2.
CVE-2026-123831 is a critical vulnerability in JetBrains CLion before version 2026.2 that allows code execution in Safe Mode via Meson project settings. The flaw involves inclusion of functionality from an untrusted control sphere (CWE-829). It has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. The issue is fixed in version 2026.2.
RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.
CVE-2026-121623 is a high-severity vulnerability in the Symfony Serializer component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. It allows arbitrary local file read via path traversal due to case-sensitive matching of the data: URI scheme in DataUriNormalizer::denormalize(). This flaw enables an attacker to bypass scheme validation by using uppercase schemes like DATA:, causing the application to treat the input as a local file path and read files accessible to the server. Exploitation requires sending a crafted request to an endpoint that deserializes untrusted input into file-related types, with no authentication needed if the endpoint is public.
CVE-2026-80301 is a vulnerability in Gen Digital's Avast Antivirus products where the sandbox on Windows improperly isolates COM interface access to the Task Scheduler service. This flaw allows a local, low-privileged attacker executing inside the sandbox to escape containment by scheduling and executing code with elevated privileges on the host system. The sandbox virtualizes file system and registry access but does not block the Task Scheduler COM pathway, enabling arbitrary code execution outside the sandbox boundaries.
A vulnerability in Avast Antivirus and related products allows a local attacker running inside the Avast sandbox on Windows to write files outside the sandbox containment. This occurs due to improper validation in the sandbox's file virtualization layer, enabling arbitrary file writes to protected system locations. Exploitation can lead to overwriting executables or system libraries, resulting in code execution with host privileges after system operations or reboot.
Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.
CVE-2026-80303 is an integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows. It allows denial of service by causing a system crash through improper length calculations during network stream processing. The vulnerability can be triggered remotely via network traffic or locally via crafted data, leading to kernel panic and system crash.
CVE-2026-12067 is a vulnerability in Gen Digital's Avast security products on Windows where missing exception handlers in the native message dispatcher (ashServ.dll) allow local attackers to crash the service by sending specially crafted JSON messages. The flaw affects multiple JSON field conversions without proper type validation or exception handling, causing uncaught exceptions that propagate and crash the service.
Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without destination deny rules and the make_request() helper performing no independent destination IP validation. Attackers can use endpoints such as GET /console/api/remote-files/<url>, POST /console/api/remote-files/upload, the HTTP Request workflow node, website crawl, or document import from URL to reach internal components like the sandbox, internal APIs, and PostgreSQL, and on AWS deployments read IAM credentials from the instance metadata service, with the HTTP Request node further enabling POST, PUT, and DELETE writes to internal services relying on network isolation for authorization.
HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.
A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue.
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.
As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.