CVE-2026-123320Low· 3.1▾ SunlitIn JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
toolbox_app < 3.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123856Medium· 6.5In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server
CVE-2026-123855High· 7.5In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs
CVE-2026-123839Medium· 4.7In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model
CVE-2026-118697Critical· 9.0In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover befo…
CVE-2026-123832Critical· 9.6In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database
CVE-2026-123831Critical· 9.6In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings