CVE watch

CVE-2026-103082 published: Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

CVE-2026-103244 published: ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to ...

CVE-2026-103245 published: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlle...

CVE-2026-103246 published: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts ...

CVE-2026-64948 published: Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.

CVE-2026-103495 published: In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

CVE-2026-103496 published: In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

CVE-2026-103497 published: In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

CVE-2026-34189 published: Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-34190 published: Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-64946 published: A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-64947 published: A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

CVE-2026-103489 published: In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

CVE-2026-103490 published: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

CVE-2026-103491 published: In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

CVE-2026-103492 published: In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

CVE-2026-103493 published: In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

CVE-2026-103494 published: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

CVE-2026-103488 published: In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

CVE-2026-15983 published: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Sub...