Skip to content

Exploited: 178

LatestCVE-2026-107622 — BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

7.1

CVE-2026-123325Verify fix

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

JetBrains YouTrack2026-11-06 10:28 UTC1 min readRead in

Summary

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

Remediation

Inventory every JetBrains YouTrack deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Referencehttps://www.jetbrains.com/privacy-security/issues-fixed/