Skip to content

Exploited: 178

LatestCVE-2026-107622 — BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

8.1

CVE-2026-123280Fix available

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

JetBrains Datalore2026-11-06 10:27 UTC1 min readRead in

Summary

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

Remediation

Inventory every JetBrains Datalore deployment, including staging.
Upgrade JetBrains Datalore to 2026.2.4.
Confirm the running version after the upgrade.

References

Referencehttps://www.jetbrains.com/privacy-security/issues-fixed/

CVSS vector

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
0 – <2026.2.4	2026.2.4

Weakness

CWE-863

Timeline

2026-11-06Publicly disclosed

Sources

CVE · NVD