Threat database

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL

In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

CVE-2026-123835 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in JetBrains Datalore before version 2026.4. This flaw allows code execution in another user's computation through an init script upload race condition. The vulnerability has a medium severity with a CVSS score of 5.9. It was fixed in version 2026.4.

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account

CVE-2026-123833 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 where database connections could be established within untrusted projects. This flaw involves the inclusion of functionality from an untrusted control sphere, potentially allowing unintended database access. The issue has a low severity rating and a CVSS score of 3.6. JetBrains fixed this vulnerability in version 2026.3.

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

RAGFlow versions prior to 0.27.0 contain a server-side request forgery (SSRF) vulnerability in the set_api_key endpoint. Authenticated attackers can supply an unvalidated base_url to force the server to make requests to arbitrary internal or external endpoints. This can be used to probe internal services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints. The vulnerability also causes raw upstream exception text to be returned in responses, leaking internal service details, open ports, and configuration fingerprints. The issue is fixed in version 0.27.0.

CVE-2026-121623 is a high-severity vulnerability in the Symfony Serializer component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. It allows arbitrary local file read via path traversal due to case-sensitive matching of the data: URI scheme in DataUriNormalizer::denormalize(). This flaw enables an attacker to bypass scheme validation by using uppercase schemes like DATA:, causing the application to treat the input as a local file path and read files accessible to the server. Exploitation requires sending a crafted request to an endpoint that deserializes untrusted input into file-related types, with no authentication needed if the endpoint is public.

CVE-2026-80301 is a vulnerability in Gen Digital's Avast Antivirus products where the sandbox on Windows improperly isolates COM interface access to the Task Scheduler service. This flaw allows a local, low-privileged attacker executing inside the sandbox to escape containment by scheduling and executing code with elevated privileges on the host system. The sandbox virtualizes file system and registry access but does not block the Task Scheduler COM pathway, enabling arbitrary code execution outside the sandbox boundaries.

A vulnerability in Avast Antivirus and related products allows a local attacker running inside the Avast sandbox on Windows to write files outside the sandbox containment. This occurs due to improper validation in the sandbox's file virtualization layer, enabling arbitrary file writes to protected system locations. Exploitation can lead to overwriting executables or system libraries, resulting in code execution with host privileges after system operations or reboot.

Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.

CVE-2026-80303 is an integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows. It allows denial of service by causing a system crash through improper length calculations during network stream processing. The vulnerability can be triggered remotely via network traffic or locally via crafted data, leading to kernel panic and system crash.

CVE-2026-12067 is a vulnerability in Gen Digital's Avast security products on Windows where missing exception handlers in the native message dispatcher (ashServ.dll) allow local attackers to crash the service by sending specially crafted JSON messages. The flaw affects multiple JSON field conversions without proper type validation or exception handling, causing uncaught exceptions that propagate and crash the service.

Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without destination deny rules and the make_request() helper performing no independent destination IP validation. Attackers can use endpoints such as GET /console/api/remote-files/<url>, POST /console/api/remote-files/upload, the HTTP Request workflow node, website crawl, or document import from URL to reach internal components like the sandbox, internal APIs, and PostgreSQL, and on AWS deployments read IAM credentials from the instance metadata service, with the HTTP Request node further enabling POST, PUT, and DELETE writes to internal services relying on network isolation for authorization.

HCL AION contains a vulnerability where user sessions do not expire after a sufficient period of inactivity. This could allow an unattended authenticated session to be accessed by another person with access to the same system, potentially leading to unauthorized viewing of information or actions performed on behalf of the user. The issue is classified as insufficient session expiration and has a low severity rating.

CVE-2026-123677 is an authorization bypass vulnerability in the xxyopen novel software affecting versions 3.0 through 3.5.0. The flaw exists in the getBookChapter function of the Book Chapter Read Handler component. An attacker can manipulate the chapterId argument to bypass authorization checks remotely. A patch identified by commit b8134e774820e0971fa9d8074405b49a01c99bdc is available to fix this issue. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. Exploit code has been publicly disclosed but there are no known exploits in the wild at this time.

Apache Axis 1.x (up to version 1.4) contains a deserialization vulnerability in handling inbound SOAP faults that allows unauthenticated remote class instantiation. This occurs when a SOAP <Fault> message includes a <detail><exceptionName> element, causing Axis to load and instantiate the named class before verifying it is an AxisFault. This can lead to remote code execution if a suitable class is present on the classpath. Axis 1.x is end-of-life and no official release fix is planned.

HCL AION contains a vulnerability in its account lockout mechanism that insufficiently restricts repeated failed login attempts. This flaw allows attackers to perform a large number of password guesses against user accounts, increasing the risk of brute-force attacks. The vulnerability may lead to unintended behavior or security impact under certain conditions. The CVSS score is 5.3, indicating a medium severity level. No affected versions or patches are specified in the available data.