{"vulnerability": "cve-2026-4936", "sightings": [{"uuid": "86d25953-0629-41b9-9ded-9b385f9045a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49366", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzdc3ymfz2d", "content": "\ud83d\udfe0 CVE-2026-49366 - High (7.8)\n\nIn JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49366/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T20:01:41.228958Z"}, {"uuid": "ba875e60-2df0-41f4-9450-d545c7f58d7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49367", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzdcd5mkn2w", "content": "\ud83d\udfe0 CVE-2026-49367 - High (8)\n\nIn JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49367/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T20:01:48.846750Z"}, {"uuid": "4586d695-28a3-435f-bad3-b7747d07834e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49367", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzdgmsr4r25", "content": "CVE-2026-49367 - JetBrains IntelliJ IDEA Command Execution Vulnerability\nCVE ID : CVE-2026-49367\n \n Published : May 29, 2026, 6:15 p.m. | 56\u00a0minutes ago\n \n Description : In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account\n \n Sev...", "creation_timestamp": "2026-05-29T20:04:12.498477Z"}, {"uuid": "513b65f1-8e21-40e9-8a2c-007fb2835e80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49368", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzdm6qegs25", "content": "CVE-2026-49368 - \"JetBrains YouTrack Stored XSS Vulnerability in Project Notification Templates\"\nCVE ID : CVE-2026-49368\n \n Published : May 29, 2026, 6:15 p.m. | 56\u00a0minutes ago\n \n Description : In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templa...", "creation_timestamp": "2026-05-29T20:07:19.029030Z"}, {"uuid": "06757d80-c2b0-491f-afbf-ae7017ad9324", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49368", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzjxbuxx72v", "content": "\ud83d\udfe0 CVE-2026-49368 - High (8.7)\n\nIn JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49368/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T22:00:54.627615Z"}, {"uuid": "fbcd553a-4a68-41ce-a3e3-e725ce75d7e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49361", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mn3lyg4rz32y", "content": "CVE-2026-49361: Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability", "creation_timestamp": "2026-05-30T17:42:38.663947Z"}, {"uuid": "582d8617-37f5-42a5-b385-c9db7fd3223a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49368", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnackhm2oa25", "content": "\ud83d\udccc CVE-2026-49368 - In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible https://www.cyberhub.blog/cves/CVE-2026-49368", "creation_timestamp": "2026-06-01T14:37:05.710324Z"}, {"uuid": "d37cfce8-95f5-40d0-bb0c-708b9f9222b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49367", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnahlicr4z22", "content": "\ud83d\udccc CVE-2026-49367 - In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account https://www.cyberhub.blog/cves/CVE-2026-49367", "creation_timestamp": "2026-06-01T16:09:06.415540Z"}, {"uuid": "2a4db8fc-92a7-4487-8117-ebd7d77dda5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49365", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwfjvdmfw2x", "content": "CVE-2026-49365: Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients", "creation_timestamp": "2026-07-05T20:19:25.273283Z"}, {"uuid": "7ce7d237-636e-41a1-971c-1a4bfeca1f42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49365", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpxzsuvqcw2h", "content": "CVE-2026-49365 - Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients\nCVE ID : CVE-2026-493...", "creation_timestamp": "2026-07-06T11:55:01.292270Z"}, {"uuid": "0ca3bcab-2664-4f51-918a-3beefce7e115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49365", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6qdclbwk2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49365 \u0432 Apache: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u0443\u0442\u0435\u0447\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445\n\n\n\nhttps://kripta.biz/posts/17222449-EE3A-4BC5-B273-298E03AE01D4", "creation_timestamp": "2026-07-09T03:53:53.052922Z"}, {"uuid": "7db2e122-8a02-47f9-94b6-4486abddb62b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49365", "type": "seen", "source": "Telegram/q3tIaYx4agF_M3da1rV7jtAQTpWs9uwXUcQ2UZM8hUpw4XQ", "content": "", "creation_timestamp": "2026-07-22T17:00:05.397368Z"}, {"uuid": "35b3a50c-dd5a-48a4-98a7-e8a363702454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49365", "type": "published-proof-of-concept", "source": "Telegram/q3tIaYx4agF_M3da1rV7jtAQTpWs9uwXUcQ2UZM8hUpw4XQ", "content": "", "creation_timestamp": "2026-07-23T00:00:09.054043Z"}, {"uuid": "95cfa0f0-231a-400c-8206-26f27f9c04c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49365", "type": "seen", "source": "https://t.me/GithubRedTeam/94456", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49365\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 09:56:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-23T04:00:06.954997Z"}, {"uuid": "72de4691-2e69-45f2-bcb8-6e4d7085574b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49365", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94456", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49365\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 09:56:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-24T00:00:10.189757Z"}, {"uuid": "b81c0a53-5d8f-45ea-8faf-4409c39659dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49364", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6j3bxg7r2r", "content": "CVE-2026-49364 - apache artemis\nIf an attacker can see traffic on the same network, they can trick Artemis into sending its cluster administrator credentials during the initial connection\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheartemis #apachefoundation #CVE #infosec", "creation_timestamp": "2026-09-10T16:50:06.331757Z"}]}