By weakness (CWE)

CWE-862: related vulnerabilities

CVEs classified under CWE-862. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

359 published vulnerabilities · page 4 of 4

• CVE-2026-49378MEDIUM 4.3

  JetBrains TeamCity contained a vulnerability where stored credentials could be inadvertently exposed through the parameter autocompletion feature. When users typed in parameter fields, the system would suggest previously stored credential values, potentially revealing sensitive authentication data to anyone with access to the TeamCity interface. This issue affects TeamCity versions prior to 2026.1 and requires an authenticated user to interact with the affected feature. The exposure is limited to local disclosure within the TeamCity environment rather than remote exfiltration.

• CVE-2026-53438MEDIUM 4.3

  Jenkins versions 2.567 and earlier (or LTS 2.555.2 and earlier) contain a permission bypass flaw that allows authenticated users holding the Item/Cancel permission to cancel build queue items without requiring Item/Read permission. This means an attacker with limited cancellation rights can disrupt builds they shouldn't be able to view or access, effectively using one permission to circumvent another. The vulnerability is not actively exploited in the wild and requires authenticated access, making it a moderate risk in most deployments.

• CVE-2026-53439MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a permission bypass vulnerability that allows low-privileged attackers to discover sensitive information about other users. Specifically, attackers who have been granted the basic Overall/Read permission can view other users' timezone settings and enumerate the names of views in other users' private "My Views" sections. This is an information disclosure issue that could support reconnaissance or social engineering attacks, though it does not enable direct system compromise.

• CVE-2026-53634MEDIUM 4.3

  Sharp, a Laravel-based content management framework, contains an authorization bypass affecting its Quick Creation Command feature in versions 9.0.0 through 9.22.2. An authenticated user without permission to create records in a specific entity could still use the Quick Creation feature to view creation forms and submit new records, provided that entity had a Quick Creation Command handler configured. This represents a privilege escalation flaw where the access control layer was not properly enforced on certain endpoints. The vulnerability has been resolved in version 9.22.3.

• CVE-2026-55542MEDIUM 4.3

  Snipe-IT, an IT asset and license management platform, contains an authorization bypass in its signature image retrieval feature when deployed with S3 object storage. Authenticated users who can guess or discover a signature filename can obtain a temporary signed S3 URL without proper permission checks. This allows unauthorized access to signature images for 5 minutes. The vulnerability stems from the S3 code path returning a URL before performing the same authorization checks that protect local file storage. Version 8.6.1 addresses this issue.

• CVE-2026-55838MEDIUM 4.3

  RustFS, a distributed storage system written in Rust, contains an authorization bypass in its metrics endpoint. The /rustfs/admin/v3/metrics endpoint fails to enforce admin-level IAM policy checks, allowing any authenticated user—even those with minimal permissions like bucket-only access—to view sensitive operational metrics about the entire cluster. This is a privilege escalation vulnerability; the system trusts that a user is authorized to access cluster-wide telemetry data without verifying their IAM role.

• CVE-2026-56384MEDIUM 4.3

  Craft CMS versions 4.x and 5.x contain a permissions bypass flaw in the asset preview feature. A Control Panel user who lacks permission to view private assets can circumvent that restriction by directly calling the preview endpoint and supplying an asset ID they shouldn't access. The system will return a preview containing a signed link to the private asset, effectively revealing content the user was never authorized to see. Exploitation requires valid Control Panel access but no special privileges beyond that.

• CVE-2026-57285MEDIUM 4.3

  Jenkins GitHub Branch Source Plugin versions 1967.1969.v205fd594c821 and earlier contain a security gap that allows any user with basic read permissions to discover the URLs of GitHub Enterprise servers connected to the Jenkins instance. This is an information disclosure issue—attackers cannot modify systems or take actions, but they can learn infrastructure details that may inform further attacks. The vulnerability requires authentication and is not currently exploited in the wild.

• CVE-2026-57286MEDIUM 4.3

  The Jenkins Git Parameter Plugin has a permission enforcement gap that lets users with basic read access to jobs extract sensitive information about the repositories those jobs use. Specifically, attackers can discover branch names, tag names, and revision metadata without needing higher-level permissions. While exploitation requires already having some level of access to Jenkins, this still represents a meaningful information disclosure risk in environments where job visibility is meant to be restricted.

• CVE-2026-57293MEDIUM 4.3

  The Jenkins Gitee Plugin contains a flaw in how it checks permissions when users attempt to view credential information. An attacker with global Item/Configure permission—but who hasn't been granted access to any specific job—can exploit this inconsistency to discover the names or IDs of credentials stored elsewhere in the Jenkins system. This is an information disclosure issue: the attacker learns what credentials exist, but cannot read their actual values or use them directly.

• CVE-2026-57297MEDIUM 4.3

  A permission flaw in the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier allows low-privileged users who have been granted basic read access to Jenkins to make unauthorized connections to external systems on behalf of the plugin. By exploiting this gap, attackers can specify which URL to connect to along with credentials (username, API key, and service key) to use—potentially allowing lateral movement, credential harvesting, or interaction with attacker-controlled infrastructure while appearing to originate from the Jenkins instance.

• CVE-2026-57299MEDIUM 4.3

  The Jenkins Contrast Continuous Application Security Plugin versions 3.11 and earlier contain a permission-check vulnerability that allows users with basic read access to discover the names of Contrast security configurations stored in Jenkins. While an attacker cannot modify or delete these configurations with this flaw alone, the ability to enumerate configuration names could support reconnaissance for follow-up attacks or reveal sensitive architectural details about an organization's security scanning setup.

• CVE-2026-57300MEDIUM 4.3

  Jenkins MCP Server Plugin versions 0.177.v629fdb_2557fe and earlier contain a missing permission check that allows attackers with basic Item/Read access to read Pipeline replay scripts from jobs they can browse. While the attacker cannot modify or disrupt those scripts, they can view their contents—potentially exposing sensitive logic, credentials, or other secrets embedded in replay configurations. This is a controlled-access vulnerability: the attacker must already have some permission within Jenkins to exploit it.

• CVE-2026-57521MEDIUM 4.3

  Bitwarden Server versions before 2026.5.0 contain a flaw in how they control access to billing information. Any user with a valid login can retrieve billing and invoice details from any organization in the system—not just ones they belong to—by simply providing a different organization's ID to the preview invoice feature. This allows unauthorized access to sensitive financial data including Stripe tax calculations, subscription status, and customer information.

• CVE-2026-57685MEDIUM 4.3

  A broken access control vulnerability exists in Martfury, a WooCommerce marketplace WordPress theme, affecting versions 3.2.8 and earlier. The flaw allows authenticated subscribers to modify data or perform actions they shouldn't be able to access, though the impact is limited to integrity rather than confidentiality or availability. This is a privilege escalation issue requiring a valid user account to exploit.

• CVE-2026-57720MEDIUM 4.3

  ThumbPress versions up to 6.3.2 contain a missing authorization flaw that allows authenticated users to perform actions they shouldn't be permitted to execute. An attacker with valid credentials can exploit incorrectly configured access controls to cause service disruption or data unavailability, though the vulnerability does not expose sensitive information or enable unauthorized modifications to data.

• CVE-2026-57921MEDIUM 4.3

  JetBrains YouTrack had a flaw that allowed authenticated users to read other users' private data through the comment templates endpoint. The vulnerability affects YouTrack versions before 2026.2.16593 and requires a valid login to exploit. While the exposure is limited to information disclosure with no ability to modify data or crash the system, it poses a privacy risk in multi-tenant or shared YouTrack deployments where sensitive project or user information may be exposed.

• CVE-2026-57925MEDIUM 4.3

  JetBrains YouTrack versions before 2026.2.16593 contain an access control flaw that allows authenticated users to read saved queries and tags they should not have permission to access. An attacker with valid login credentials can view sensitive search configurations and organizational metadata without proper authorization checks. This is not a pre-authentication or unauthenticated attack; it requires an existing account on the YouTrack instance.

• CVE-2026-57954MEDIUM 4.3

  Elide, a Java framework for building APIs, contains a flaw in how it validates sorting requests. When users ask an API to sort data by a specific field, Elide is supposed to check whether they have permission to see that field. In versions up to 7.1.17, this permission check is skipped for sort expressions, meaning an attacker with basic API access can sort results by fields they shouldn't be able to access. By observing how the rows reorder when sorting by different fields, an attacker can infer the relative values of hidden fields—essentially reading data they have no permission to see. This vulnerability affects both JSON:API and GraphQL endpoints.

• CVE-2026-58373MEDIUM 4.3

  CVAT, a computer vision annotation tool, has an authorization flaw that lets authenticated users discover which quality reports exist in other organizations. An attacker with valid login credentials can probe the quality reports API by trying different report IDs and observing whether the system returns a 'not found' or 'server error' response—leaking the fact that a report exists without revealing its contents. This affects CVAT versions before 2.69.0.

• CVE-2026-59217MEDIUM 4.3

  Open WebUI before version 0.10.0 contains an authorization bypass flaw that allows read-only users of a knowledge base to upload files and attach them to knowledge bases they shouldn't be able to modify. When users upload files, the application accepts a metadata parameter specifying which knowledge base to link the files to, but fails to check whether the uploading user actually has write access to that knowledge base. This lets lower-privilege users escalate their capabilities within the platform by injecting content into knowledge bases they can only read.

• CVE-2026-59227MEDIUM 4.3

  Open WebUI, a self-hosted AI platform, contains an authorization bypass vulnerability in its image-editing API endpoint. Prior to version 0.10.0, any verified user could invoke server-side image editing operations without permission checks, even if administrators had disabled the feature globally or restricted it at the user level. This allowed non-admin users to consume server resources and leverage admin-configured AI provider credentials for image manipulation tasks they should not have access to.

• CVE-2026-59709MEDIUM 4.3

  Ghostfolio contains an authorization bypass vulnerability in its portfolio holding tag management feature. Users who are granted read-only access to a portfolio through share tokens can unexpectedly modify tags on holdings belonging to the portfolio owner. The vulnerability stems from improper permission validation when the system processes impersonation requests, allowing attackers to escalate their limited access rights to perform modification actions they should not be permitted to execute.

• CVE-2026-6689MEDIUM 4.3

  Mattermost has a permissions bypass vulnerability affecting multiple versions where authenticated users with team-creation rights can inappropriately configure invitation settings during team setup. Specifically, users lacking the PermissionInviteUser permission can set AllowOpenInvite (making a team publicly joinable) and AllowedDomains (restricting team membership to specific domains) during POST-based team creation—settings they would normally be blocked from configuring on existing teams. The vulnerability requires an authenticated account and results in unauthorized configuration of team access controls, not data disclosure or system failure.

• CVE-2026-7492MEDIUM 4.3

  GitLab Community Edition and Enterprise Edition contain a flaw in how they control access to cross-project reference pages. An attacker with a valid GitLab login can query these pages to determine whether private projects exist—information that should remain hidden. The vulnerability affects many versions released over the past several years, though no unauthenticated exploitation path has been confirmed. GitLab has released patches for the most recent major versions.

• CVE-2026-7523MEDIUM 4.3

  The Alba Board plugin for WordPress contains a flaw that allows attackers to bypass access controls and view sensitive project information they shouldn't be able to see. An authenticated user with basic subscriber access can retrieve private card data—titles, descriptions, due dates, and comments—that should be restricted to administrators and editors only. More critically, the vulnerability can be exploited by unauthenticated site visitors if the Alba Board shortcode appears anywhere on the website, because the security token (nonce) is exposed in the page source. All versions up to and including 2.1.3 are affected.

• CVE-2026-7621MEDIUM 4.3

  The SMTP2GO for WordPress plugin contains an authorization flaw that allows any logged-in user with subscriber-level permissions or higher to delete all SMTP email logs from the database or export sensitive email records to CSV format. This affects all versions up to 1.16.0 and exposes recipient addresses, sender information, message subjects, and API response data. An attacker with basic user access can perform these destructive and data-exfiltration actions without additional authentication checks.

• CVE-2026-7624MEDIUM 4.3

  The Squirrly SEO plugin for WordPress has an access control flaw that allows lower-privileged users to perform actions meant only for administrators. Specifically, a contributor-level user can disconnect the website from Google Search Console and Google Analytics by invoking backend API calls that should be blocked. This is a privilege escalation issue affecting all versions up to 12.4.16.

• CVE-2026-8472MEDIUM 4.3

  GitLab Enterprise Edition (EE) contains a flaw that allows authenticated users with minimal permissions to access sensitive work item metadata from private projects they shouldn't be able to view. The vulnerability stems from missing authorization checks in the application logic, meaning the system failed to properly verify whether a user had legitimate access before exposing this information. An attacker would need valid GitLab credentials and some level of access to the platform, but the actual permissions required are low, making this a concerning insider-risk scenario.

• CVE-2026-8614MEDIUM 4.3

  The Assistio plugin for WordPress contains a vulnerability that allows authenticated users with basic Subscriber-level permissions to delete critical plugin settings, including OAuth configuration data. The vulnerability exists because the plugin fails to verify that a user has proper authorization and fails to include a security token (nonce) on the function that deletes settings. An attacker with even minimal WordPress account access can exploit this to break the plugin's connection to the Assistio bot service.

• CVE-2026-8682MEDIUM 4.3

  The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On WordPress plugin contains a flaw that allows users with basic subscriber access to change critical plugin settings they should not be able to modify. An authenticated attacker can bypass authorization checks to write arbitrary data directly to the plugin's configuration stored in the database, potentially affecting how the 3D viewer and virtual try-on features function across the site.

• CVE-2026-8688MEDIUM 4.3

  The Advance Nav Menu Manager plugin for WordPress contains an authorization bypass flaw that allows low-privilege users—those with subscriber-level access or higher—to manipulate navigation menu items without proper permission checks. Attackers can duplicate, copy, move, or publish navigation items, potentially defacing site structure or injecting malicious navigation elements. The vulnerability stems from inadequate permission validation during menu item operations and affects all versions up to and including 1.3.

• CVE-2026-8689MEDIUM 4.3

  The Visualizer: Tables and Charts Manager WordPress plugin contains an authorization bypass flaw that allows logged-in users with minimal privileges (Subscriber level and above) to create chart posts without proper permission checks and to view or modify charts belonging to other users, including site administrators. The vulnerability affects all versions through 3.11.14 and stems from missing capability validation in two critical AJAX functions. While the flaw requires an authenticated account, the low barrier to entry and potential for unauthorized data access make it a meaningful risk for multi-user WordPress installations.

• CVE-2026-8976MEDIUM 4.3

  The RSS Aggregator by Feedzy plugin for WordPress fails to properly verify user permissions, allowing contributors and higher-level users to perform administrative actions they shouldn't be able to access. An authenticated attacker with basic contributor rights can create RSS import jobs, delete all posts from any import, clear error logs, and view sensitive taxonomy and post metadata information. The vulnerability is particularly dangerous because the security token needed to perform these actions is automatically exposed to anyone who can edit posts through the block editor interface—no additional hacking or theft is required.

• CVE-2026-9008MEDIUM 4.3

  The Page-list plugin for WordPress contains an authorization flaw in its shortcode feature that allows authenticated users with contributor-level or higher permissions to view sensitive content they shouldn't be able to access. By inserting a specially crafted shortcode into a draft post and previewing it, attackers can extract titles, body text, and metadata from private or draft pages across the entire site. The vulnerability exists because the plugin doesn't verify whether the current user is permitted to view the pages being queried.

• CVE-2026-9013MEDIUM 4.3

  The Bogo WordPress plugin contains a flaw that allows authenticated users with basic subscriber-level permissions or higher to read sensitive content from private, draft, and password-protected posts on a site. An attacker exploits this by requesting a translation of a post they shouldn't have access to, then extracting the raw text from the duplicated version that the translation feature creates. The vulnerability is most impactful when the attacker has contributor-level access, since that's when they can actually view the exposed content. Any WordPress site using Bogo version 3.9.1 or earlier is potentially at risk.

• CVE-2026-9015MEDIUM 4.3

  The Equalize Digital Accessibility Checker plugin for WordPress contains a flaw that allows users with basic subscriber access to modify accessibility audit findings they shouldn't be able to touch. An authenticated attacker can change whether issues are marked as ignored, alter the reason for ignoring them, and add comments to any accessibility finding on the site. In some cases, they can perform bulk modifications across multiple related findings at once. This means someone with minimal privileges could systematically hide or dismiss accessibility compliance problems, undermining the integrity of WCAG and ADA audit records without proper authorization.

• CVE-2026-9050MEDIUM 4.3

  Slider Revolution, a popular WordPress plugin, contains a flaw that allows contributors and higher-privileged users to disable any plugin on a WordPress site without proper authorization checks. An attacker with basic contributor access—a common account level in multi-author sites—can leverage this to shut down security plugins, backup solutions, or other critical extensions. The vulnerability affects versions 6.0.0 through 6.7.55 and 7.0.0 through 7.0.14.

• CVE-2026-9184MEDIUM 4.3

  The 24liveblog WordPress plugin fails to properly validate who is making certain administrative requests, allowing logged-in authors and higher-privilege users to hijack the plugin's connection to the 24liveblog service. An attacker with author-level access can inject false credentials that redirect the plugin to use the attacker's 24liveblog account instead of the legitimate site owner's, or alternatively overwrite administrator accounts' tokens to lock them out of the integration.

• CVE-2026-9199MEDIUM 4.3

  The Equalize Digital Accessibility Checker WordPress plugin contains a flaw that allows authors and higher-privileged users to manipulate accessibility audit records on the entire site, not just their own posts. An attacker with author-level access can use an accessibility issue from one of their posts as a 'skeleton key' to dismiss, ignore, or restore similar issues site-wide—including those attached to administrator posts. While this doesn't grant direct read access to sensitive data, it enables unauthorized modification of critical compliance records, undermining audit integrity.

• CVE-2026-9230MEDIUM 4.3

  The Quiz and Survey Master plugin for WordPress contains a flaw that allows users with contributor-level permissions (or higher) to modify quizzes owned by other users, alter quiz result pages, and redirect notification emails to addresses they control. The vulnerability stems from incomplete permission checks when users attempt to modify quiz configurations. An attacker exploits this by first retrieving a valid authentication token from one quiz, then reusing it to gain unauthorized access to another user's quiz settings.

• CVE-2026-9233MEDIUM 4.3

  The Quiz and Survey Master plugin for WordPress has a flaw that allows users with basic contributor permissions (or higher) to manipulate quiz output templates in ways they shouldn't be able to. An authenticated attacker can create, modify, or delete templates and inject unfiltered HTML and scripts into them. While the vulnerability requires an existing WordPress account, it sidesteps proper permission checks that should prevent lower-privilege users from touching these administrative templates.

• CVE-2026-9234MEDIUM 4.3

  The JTL-Connector for WooCommerce plugin contains authorization flaws that allow low-privileged WordPress users (Subscriber level and above) to perform administrative actions without proper permission checks. Specifically, attackers can change plugin configuration, download sensitive log files containing developer information, and delete those logs. This bypasses WordPress's built-in permission model and could lead to configuration tampering or information disclosure.

• CVE-2026-9235MEDIUM 4.3

  The DHL eCommerce (Benelux) for WooCommerce plugin contains a flaw that allows low-privileged users to create or delete shipping labels for any order in a WooCommerce store. An attacker with even a basic Subscriber account can manipulate shipping operations belonging to other customers or administrators, disrupting order fulfillment and potentially causing financial or operational harm. The vulnerability exists because the plugin fails to verify user permissions and prevent cross-site request forgery attacks on these sensitive functions.

• CVE-2026-9237MEDIUM 4.3

  A flaw in the Crew HRM WordPress plugin (versions up to 1.2.2) allows any logged-in user with basic subscriber access to delete, modify, or duplicate job listings that belong to other users or the organization. The vulnerability exists because the plugin fails to verify whether a user actually has permission to perform these actions. Additionally, the security token the plugin relies on to prevent unauthorized requests is accidentally exposed to all logged-in visitors, making it trivial for attackers to bypass the intended safeguard.

• CVE-2026-9240MEDIUM 4.3

  The Colissimo Officiel shipping plugin for WooCommerce has a flaw that allows any authenticated user—even those with basic Subscriber access—to modify shipping details on orders that don't belong to them. An attacker can change the shipping method, pickup point, or delivery address for any order in the system without needing special permissions or providing a security token. This is a privilege escalation issue: an attacker with minimal account rights gains the ability to tamper with fulfillment data across the entire store.

• CVE-2026-9616MEDIUM 4.3

  The Generate Security.txt plugin for WordPress has an authorization flaw that allows any logged-in subscriber (or higher-privilege user) to delete the site's security.txt file or create a .well-known directory without proper permission checks. An attacker with even basic subscriber access can invoke these actions directly through the plugin's AJAX endpoints, bypassing intended access controls. This affects all versions up to and including 1.0.12.

• CVE-2026-9619MEDIUM 4.3

  The Reviews and Rating – Docplanner plugin for WordPress contains a flaw that allows any logged-in user with subscriber-level permissions or higher to perform actions they shouldn't be able to do. Specifically, attackers can make the plugin fetch content from external websites without authorization, store that scraped data in the WordPress database, and send emails impersonating the site administrator. This requires an attacker to already have legitimate WordPress access, but the damage they can inflict goes well beyond what a normal subscriber should control.

• CVE-2026-9857MEDIUM 4.3

  The Invoice123 WordPress plugin contains a flaw that allows users with basic subscriber accounts to make unauthorized changes to critical invoice and payment settings. Specifically, attackers can replace the plugin's API key, reconfigure invoice settings, and modify tax rate information in WooCommerce—actions they should not be able to perform. This vulnerability affects all versions up to and including 1.7.0 and requires no special technical knowledge to exploit, only valid WordPress login credentials at the subscriber level or higher.

• CVE-2026-2299MEDIUM 4.2

  The Mattermost Google Drive plugin contains an authorization bypass flaw that allows authenticated users to share files to private channels they shouldn't have access to and expose confidential channel membership details. The vulnerability exists in versions before 1.1.0 and requires an attacker to have valid Mattermost credentials and a connected Google account. While the impact is limited to information disclosure and minor integrity issues, it creates a pathway for insider threats or compromised accounts to leak sensitive organizational structure and collaboration details.

• CVE-2026-57307MEDIUM 4.2

  Jenkins Zowe zDevOps Plugin versions 1.1.3.50.ve350c9b_450b_1 and earlier contain a permission check vulnerability that allows users with basic read access to Jenkins to exploit credential handling flaws. An attacker with Overall/Read permission can leverage known credential IDs to connect to arbitrary URLs using those stored credentials, potentially exposing sensitive authentication material. This is a moderate-severity issue that requires authenticated access but poses a real insider threat risk in shared Jenkins environments.

• CVE-2026-48709LOW 3.7

  OliveTin is a web application that lets users execute predefined shell commands through a browser interface. Versions up to 3000.0.0 contain a flaw where one specific API endpoint (ValidateArgumentType) skips authentication checks that all other endpoints perform. When the application is configured to require login for guest users—a stricter security posture—this endpoint remains openly accessible to anyone on the network, allowing attackers to discover which shell commands are available and learn their argument requirements without needing credentials.

• CVE-2026-57946LOW 3.7

  Invidious, an open-source YouTube alternative, contains a flaw in how it controls access to private playlists. Before version 2.20260626.0, an attacker without any account or credentials can retrieve the contents of a private playlist—including video listings, the owner's email address, and other details—by directly requesting the RSS feed for that playlist. The vulnerability requires knowledge of a valid playlist ID but does not require authentication, making it a straightforward information disclosure risk for users with private playlists.

• CVE-2026-0057LOW 3.3

  A permissions enforcement gap in Android's Contacts Provider allows local applications to view incoming call phone numbers and related metadata without explicit authorization. The issue requires local access to the device but no special privileges or user action during exploitation, making it a concern for applications that should be restricted from call monitoring data.

• CVE-2026-0145LOW 3.3

  CVE-2026-0145 is a permission bypass vulnerability in Android's KeyMint component that allows a local attacker with basic user privileges to read sensitive information without needing to interact with the system or escalate their access level. The flaw stems from a logic error in how permissions are validated, creating an unintended pathway for unauthorized data access.

• CVE-2026-0158LOW 3.3

  A flaw in Android's Camera application allows a local user to view photos they shouldn't be able to access. The vulnerability stems from missing permission validation when accessing photo data. Since no special privileges or user interaction are required beyond initial device access, any app or user account on the device could potentially read private photos. The actual impact is limited to unauthorized photo disclosure—the vulnerability doesn't enable device compromise or broader system damage.

• CVE-2026-3176LOW 3.1

  GitLab Enterprise Edition versions 18.6 through 18.11.5, 19.0.0 through 19.0.2, and 19.1.0 contain a flaw that could allow an authenticated user with limited permissions to view project information they should not have access to. The vulnerability requires specific conditions to be triggered and is rated low-severity, but it does bypass intended authorization controls.

• CVE-2026-57922LOW 3.1

  JetBrains YouTrack versions before 2026.2.16593 contained a flaw that allowed authenticated users to disclose project settings through the Model Context Protocol (MCP) integration. The vulnerability requires valid login credentials and specific conditions to exploit, making it a lower-risk issue suited for standard patch cycles rather than emergency response.

• CVE-2026-59226LOW 3.1

  Open WebUI versions 0.9.0 through 0.9.x contain a privilege and access control flaw where deactivated users can still trigger scheduled automation tasks and access AI models they should no longer have permission to use. The vulnerability stems from insufficient re-validation when executing stored automations and overly lenient model access checks. An attacker with a deactivated account could potentially continue running automations or accessing restricted models until the account is fully removed from the system.