Threat database

CVE-2026-123859 is a SQL injection vulnerability in the Snowflake Connector for Python and its Universal Core variant. When identifier escaping is disabled via a non-default configuration, the write_pandas() function fails to escape DataFrame column names before embedding them in SQL statements. This allows crafted column names to inject additional SQL commands, potentially enabling unauthorized reading, modification, or deletion of data accessible to the Snowflake role used by the application. Exploitation requires attacker-controlled column names passed to this functionality. Fixed versions 4.8.1 and 5.2.0 are available and users must upgrade manually.

In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server

CVE-2026-123855 is a high-severity OS command injection vulnerability in JetBrains Toolbox App versions before 3.6.1. The flaw allows command injection via enterprise configuration URLs. It was fixed in version 3.6.1.

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

CVE-2026-123853 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via project-controlled JVM options of the build process. The flaw is due to inclusion of functionality from an untrusted control sphere (CWE-829).

CVE-2026-123852 is a high-severity vulnerability in JetBrains Junie GitHub Action versions before 1.8.0. It involves incorrect authorization (CWE-863) that allows code execution with workflow credentials via fork updates. The issue is fixed in version 1.8.0.

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

CVE-2026-123849 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in untrusted projects via the Terraform File Watchers feature. The flaw is classified under CWE-829, which involves inclusion of functionality from an untrusted control sphere. This vulnerability has been fixed in version 2026.3.

CVE-2026-123848 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 where host name verification was missing for server TLS certificates. This improper validation of certificates (CWE-297) could allow an attacker to present a TLS certificate that does not match the server's host name, potentially enabling man-in-the-middle attacks. The issue has been fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion

In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

CVE-2026-123842 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.3 that allows arbitrary file write via symbolic links when extracting plugin archives. This flaw is due to improper handling of symlinks during plugin extraction. The issue is fixed in version 2026.3.

CVE-2026-123841 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 that allows code execution via symbolic links in an imported settings archive. This flaw is related to improper handling of symlinks (CWE-59) during the import process. The vulnerability has a high severity with a CVSS score of 7.8 and was fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs