Threat database

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

CVE-2026-123842 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.3 that allows arbitrary file write via symbolic links when extracting plugin archives. This flaw is due to improper handling of symlinks during plugin extraction. The issue is fixed in version 2026.3.

CVE-2026-123841 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 that allows code execution via symbolic links in an imported settings archive. This flaw is related to improper handling of symlinks (CWE-59) during the import process. The vulnerability has a high severity with a CVSS score of 7.8 and was fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model

CVE-2026-123838 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via a UI Designer form file due to inclusion of functionality from an untrusted control sphere (CWE-829). This flaw is fixed in version 2026.3.

CVE-2026-123837 is an OS command injection vulnerability in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.1. The flaw allows command injection via Tomcat run configurations on Windows Subsystem for Linux (WSL) when working with untrusted projects. This vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. A fix is available in version 2026.3.

In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account

In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects

CVE-2026-123832 is a critical vulnerability in JetBrains CLion before version 2026.2 that allows code execution in Safe Mode via a JSON compilation database. This flaw involves the inclusion of functionality from an untrusted control sphere, classified under CWE-829. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. A fix is available in version 2026.2.

CVE-2026-123831 is a critical vulnerability in JetBrains CLion before version 2026.2 that allows code execution in Safe Mode via Meson project settings. The flaw involves inclusion of functionality from an untrusted control sphere (CWE-829). It has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. The issue is fixed in version 2026.2.

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.

CVE-2026-121623 is a high-severity vulnerability in the Symfony Serializer component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. It allows arbitrary local file read via path traversal due to case-sensitive matching of the data: URI scheme in DataUriNormalizer::denormalize(). This flaw enables an attacker to bypass scheme validation by using uppercase schemes like DATA:, causing the application to treat the input as a local file path and read files accessible to the server. Exploitation requires sending a crafted request to an endpoint that deserializes untrusted input into file-related types, with no authentication needed if the endpoint is public.

CVE-2026-80301 is a vulnerability in Gen Digital's Avast Antivirus products where the sandbox on Windows improperly isolates COM interface access to the Task Scheduler service. This flaw allows a local, low-privileged attacker executing inside the sandbox to escape containment by scheduling and executing code with elevated privileges on the host system. The sandbox virtualizes file system and registry access but does not block the Task Scheduler COM pathway, enabling arbitrary code execution outside the sandbox boundaries.

A vulnerability in Avast Antivirus and related products allows a local attacker running inside the Avast sandbox on Windows to write files outside the sandbox containment. This occurs due to improper validation in the sandbox's file virtualization layer, enabling arbitrary file writes to protected system locations. Exploitation can lead to overwriting executables or system libraries, resulting in code execution with host privileges after system operations or reboot.

Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.