Skip to content

Exploited: 178

LatestCVE-2026-107622 — BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

7.4

CVE-2026-123282Fix available

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

JetBrains Datalore2026-11-06 10:27 UTC1 min readRead in

Summary

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

Remediation

Inventory every JetBrains Datalore deployment, including staging.
Upgrade JetBrains Datalore to 2026.4.
Confirm the running version after the upgrade.

References

Referencehttps://www.jetbrains.com/privacy-security/issues-fixed/

CVSS vector

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected versions

Version	Fixed in
0 – <2026.4	2026.4

Weakness

CWE-672

Timeline

2026-11-06Publicly disclosed

Sources

CVE · NVD