A code execution vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.4. The flaw allows code execution in untrusted projects via the Terraform tool path setting. This vulnerability has a high severity rating with a CVSS score of 7.8.
A privilege escalation vulnerability exists in JetBrains Hub versions prior to 2026.2.52519, where an attacker could exploit forged email verification to gain elevated privileges.
JetBrains Datalore versions before 2026.4 contain an improper authorization vulnerability that allows users with notebook viewer permissions to modify files. This flaw could lead to unauthorized integrity impact without affecting confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.4.
A stored cross-site scripting (XSS) vulnerability exists in JetBrains Datalore versions prior to 2026.4. The vulnerability occurs in notebook charts via the Vega editor link, allowing an attacker to inject malicious scripts that are stored and later executed in the context of a user's browser session.
A vulnerability in JetBrains Hub versions before 2026.2.52519 allows an attacker with limited privileges to disable enforced two-factor authentication via the profile update endpoint. This flaw could lead to a significant reduction in account security by bypassing multi-factor authentication requirements.
A critical privilege escalation vulnerability exists in JetBrains Hub versions prior to 2026.2.52556. The flaw allows an attacker with limited privileges to escalate their access by manipulating email authentication details during the verification process.
A vulnerability in JetBrains Datalore versions before 2026.4 allowed unauthenticated users to access hidden notebook code via the public interactive report content endpoint. This exposure could lead to unauthorized disclosure of potentially sensitive code. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact primarily affecting confidentiality. No official patch or remediation details are provided in the available data.
A vulnerability in JetBrains Datalore before version 2026.4 allows improper owner validation, which enables unauthorized users with limited privileges to read issues and runs from other workspaces. This flaw does not allow modification or denial of service but exposes some confidential information across workspace boundaries.
A vulnerability in JetBrains CLion before version 2026.3 and 2026.2.4.1 allows local users on Linux systems to access the debug session environment due to missing authentication. This issue could expose sensitive debug session information to unauthorized local users.
JetBrains Datalore versions prior to 2026.4 contain a vulnerability that allows account takeover via SSO sign-in to a pre-registered account. This issue enables an attacker to gain unauthorized access to user accounts through the single sign-on mechanism. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.
A command execution vulnerability exists in JetBrains Datalore versions prior to 2026.3. This flaw allows injection of JVM options in the database task container, potentially enabling unauthorized command execution.
A vulnerability in JetBrains Datalore before version 2026.4 allows view-only collaborators to modify shared content due to improper authorization on workspace move operations.
JetBrains Datalore versions prior to 2026.4 contain a vulnerability where account tokens lack expiration validation. This flaw allows an attacker to create a new authenticated session using an expired or otherwise invalid token, potentially leading to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.4.
JetBrains Datalore versions before 2026.2.4 contain a vulnerability that allows unauthenticated users to execute code via published interactive reports. This flaw could lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is identified as CVE-2026-123280 with a high severity score of 8.1.
A resource allocation vulnerability in ninenines cowboy from version 2.18.0 onward allows unauthenticated remote attackers to exhaust server memory by sending excessive data on HTTP/1.1 keep-alive connections. The issue arises because the server appends incoming data to a buffer without limits while a request handler is running, potentially causing out-of-memory conditions in the Erlang VM.
The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress versions up to and including 8.0.26 contains a PHP code injection vulnerability. This flaw arises from insufficient sanitization of the feedConfigCustom2 parameter, which is passed directly to PHP's eval() function during feed generation. Authenticated users with Shop Manager-level access or higher can exploit this to execute arbitrary PHP code, potentially leading to full remote code execution and site takeover. The vulnerability is exploitable by default as the ctxfeed_custom2_eval_enabled option is true out of the box.
A vulnerability in JetBrains IntelliJ IDEA before version 2026.3 allows code execution via an unauthenticated JDBC worker RMI endpoint. This flaw could enable an attacker with local access to execute arbitrary code. The vulnerability has a medium severity rating with a CVSS score of 6.7.
JetBrains Datalore versions before 2026.4 contain a vulnerability where private notebook files could be downloaded without authentication through published interactive reports. This allows unauthorized users to access sensitive notebook content. The vulnerability has a CVSS score of 5.9, indicating a medium severity impact primarily affecting confidentiality.
A resource exhaustion vulnerability exists in ninenines cowlib HTTP/2 implementation due to lack of limits on the size of decoded header lists. An unauthenticated remote peer can exploit this by sending specially crafted HPACK-indexed header fields, causing excessive memory allocation and potential denial of service. This affects cowlib versions from 2.7.0 onward.
A vulnerability in JetBrains Datalore versions before 2026.4 allows notebook code to execute commands in the sidecar container via the mount broker. This could lead to high impact on confidentiality, integrity, and availability of the affected system.