Tagged “cve.org”
CVEs tagged cve.org, newest first.
46330 CVEsRSS
CVE-2026-123277Medium· 5.0In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux
CVE-2026-123280High· 8.1In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
CVE-2026-123278Medium· 6.7In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
CVE-2026-123282High· 7.4In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
CVE-2026-123281High· 7.5In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
CVE-2026-123279Critical· 9.0In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
CVE-2026-123283Medium· 6.8In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
CVE-2026-123290Medium· 5.3In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
CVE-2026-123285Medium· 6.3In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
CVE-2026-123289Medium· 5.4In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
CVE-2026-123284Medium· 6.5In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
CVE-2026-123287Medium· 5.9In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
CVE-2026-123286Medium· 5.9In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
CVE-2026-123297Medium· 6.8In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
CVE-2026-123291Medium· 4.3In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
CVE-2026-123294Critical· 9.6In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
CVE-2026-123288Medium· 5.4In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
CVE-2026-123295High· 8.1In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
CVE-2026-123293High· 7.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
CVE-2026-123296High· 7.5In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
CVE-2026-123292Low· 2.7In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
CVE-2026-123300Low· 2.7In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
CVE-2026-123298Medium· 5.0In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
CVE-2026-123301High· 8.2In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
CVE-2026-123299Low· 3.1In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
CVE-2026-123305High· 7.5In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
CVE-2026-123307Medium· 6.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
CVE-2026-123306High· 7.4In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
CVE-2026-123308Medium· 6.3In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
CVE-2026-123304High· 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path