🔓 Zephyr Flash Syscall Flaw Enables Kernel Privilege Escalation
Teams shipping Zephyr devices with userspace enabled should prioritize the fix, especially where untrusted or lower-privileged code can invoke flash syscalls. Apply the update that validates both flash device objects before dereferencing them.
CVE-2026-9771 affects the flash_copy() syscall trust boundary in Zephyr builds with CONFIG_USERSPACE enabled. Missing validation of attacker-controlled flash device pointers can allow an unprivileged thread to invoke attacker-chosen function pointers in supervisor mode, resulting in local privilege escalation, with denial-of-service and information disclosure also possible. The vulnerability is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
💥 Glances Action Templates Can Reconstruct Shell Operators
Administrators using Glances action templates should upgrade to 4.5.6 promptly, particularly when monitoring data may come from untrusted processes or containers. Review action templates that invoke commands as an additional precaution.
CVE-2026-68518 affects Glances before 4.5.6. Its Mustache sanitization can be bypassed by adjacent unescaped variables, allowing attacker-controlled process or container fields to reconstruct shell operators that are subsequently executed through administrator-configured action templates. The vulnerability is rated HIGH with CVSS 8.8 and is fixed in Glances 4.5.6.
🔗 Read more 🔗
Source: NVD
🛑 Malformed Host Header Can Crash WebSocket Servers
Operators of internet-facing applications using websocket-driver should upgrade to 0.8.2 quickly. The flaw is remotely triggerable and can be used for denial-of-service when application-level exception handling does not contain it.
CVE-2026-61666 affects websocket-driver before 0.8.2. A remote client can supply a malformed Host header that causes URI.parse to raise an uncaught URI::InvalidURIError, potentially crashing TCP-backed WebSocket servers whose applications do not handle the exception. The vulnerability is rated HIGH with CVSS 8.9 and is fixed in version 0.8.2.
🔗 Read more 🔗
Source: NVD
🛡️ Endpoint Privilege Management Tamper Protection Can Be Bypassed
Organizations using the affected Endpoint Privilege Management Windows deployment tooling should apply the vendor-provided remediation promptly. Systems where tamper protection is a key control against local administrative abuse deserve particular attention.
CVE-2026-40145 affects an Endpoint Privilege Management Windows Deployment support utility and its interaction with agent tamper-protection controls. Under certain conditions, protections intended to apply to the utility process may not be enforced correctly. The vulnerability is rated HIGH with CVSS 7.1.
🔗 Read more 🔗
Source: NVD
⚡ PyCharm Jupyter MCP Tools Expose Unauthenticated Code Execution
PyCharm users and managed development environments should upgrade to 2026.2.1 or later urgently, especially where Jupyter MCP functionality is reachable by untrusted users or networks. Unauthenticated code-execution paths warrant fast remediation.
CVE-2026-75060 affects JetBrains PyCharm before 2026.2.1. Unauthenticated access to Jupyter MCP tools could lead to code execution. The vulnerability is rated HIGH with CVSS 8.4.
🔗 Read more 🔗
Source: NVD
📝 IntelliJ Markdown Export Flaw Enables Code Execution
IntelliJ IDEA users should move to 2026.2.1 or later promptly, with extra urgency for teams that open or export Markdown from untrusted projects or content. Treat the issue as a code-execution risk rather than a cosmetic Markdown bug.
CVE-2026-75056 affects JetBrains IntelliJ IDEA before 2026.2.1. The Markdown export tool could be abused to achieve code execution. The vulnerability is rated HIGH with CVSS 7.8.
🔗 Read more 🔗
Source: NVD
🔀 YouTrack Flaw Allows Unauthorized Cross-Organization Project Transfers
Multi-organization YouTrack deployments should update to 2026.2.17917 or later as a priority. Administrators should also review recent project-transfer activity for unexpected movement between organizations.
CVE-2026-75051 affects JetBrains YouTrack before 2026.2.17917. The vulnerability allows unauthorized project transfers between organizations, creating a serious authorization and tenant-boundary risk. It is rated HIGH with CVSS 8.1.
🔗 Read more 🔗
Source: NVD
🧨 Crafted Type Parameters Can DoS JetBrains YouTrack
YouTrack administrators should update affected branches to the fixed releases promptly, especially for publicly reachable instances. The primary risk is service disruption from maliciously crafted requests.
CVE-2026-75050 affects JetBrains YouTrack versions before 2026.1.13901 and 2026.2.17950. Crafted type parameters can be used to trigger a denial-of-service condition. The vulnerability is rated HIGH with CVSS 7.1.
🔗 Read more 🔗
Source: NVD
🧪 YouTrack Fenced Code Labels Enable Stored XSS
YouTrack administrators should upgrade to 2026.2.18068 or later quickly, particularly on instances where untrusted users can create or edit formatted content. Stored XSS can affect multiple users and may target privileged sessions.
CVE-2026-75048 affects JetBrains YouTrack before 2026.2.18068. Attackers can trigger stored cross-site scripting through the language label of a fenced code block, causing malicious content to persist and execute when viewed. The vulnerability is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD
🚨 Unauthenticated Attackers Can Download YouTrack Database Backups
Internet-facing YouTrack installations should be patched immediately to the fixed release for their branch. Because exploitation requires no authentication and can expose full database backups, administrators should also investigate logs for suspicious backup downloads or shared-draft activity.
CVE-2026-75045 affects JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112. An unauthenticated attacker can use a shared draft signature to download database backups, potentially exposing highly sensitive application data. The vulnerability is rated CRITICAL with CVSS 9.1.
🔗 Read more 🔗
Source: NVD
🗑️ YouTrack Authorization Flaw Lets Users Delete Arbitrary Entities
YouTrack administrators should upgrade affected installations promptly, particularly where many users have accounts or access is shared across trust boundaries. Review mailbox-endpoint activity for unexpected deletion operations where feasible.
CVE-2026-75044 affects JetBrains YouTrack before 2025.3.156085, 2026.1.13914, and 2026.2.18095. Missing authorization on the mailbox endpoint allows an authenticated user to delete arbitrary entities. The vulnerability is rated HIGH with CVSS 8.1.
🔗 Read more 🔗
Source: NVD
📂 PostCSS Source Map Handling Can Expose Arbitrary Map Files
Applications and build services that process untrusted CSS with PostCSS should upgrade to 8.5.18 promptly. Where immediate patching is difficult, disabling source-map processing for untrusted input can reduce exposure.
CVE-2026-73646 affects PostCSS before 8.5.18. Attacker-controlled sourceMappingURL values can traverse to or reference absolute .map paths, allowing untrusted CSS processed with source maps enabled to disclose sourcesContent from reachable map files. The vulnerability is rated HIGH with CVSS 7.5 and is fixed in version 8.5.18.
🔗 Read more 🔗
Source: NVD