Threat database

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

CVE-2026-123287 is an authorization vulnerability in JetBrains Datalore before version 2026.4. It allows unauthorized users to download private notebook files via published interactive reports without authentication. The issue is fixed in version 2026.4.

CVE-2026-123286 is an authorization vulnerability in JetBrains Datalore before version 2026.4 that allows unauthorized reading of the notebook owner's file storage session token. This flaw could lead to unauthorized access to sensitive session information. The vulnerability has a medium severity with a CVSS score of 5.9 and was fixed in version 2026.4.

CVE-2026-123285 is a vulnerability in JetBrains Datalore before version 2026.3 that allows command execution in the database task container via JVM options injection. This flaw is classified as CWE-88 Argument Injection. The issue has been fixed in version 2026.3.

CVE-2026-123284 is an authorization vulnerability in JetBrains Datalore before version 2026.4. It allows view-only collaborators to improperly modify shared workspace content due to incorrect authorization checks on workspace moves. This issue is fixed in version 2026.4.

CVE-2026-123283 is a vulnerability in JetBrains Datalore before version 2026.4 that allows account takeover via SSO sign-in to a pre-registered account due to improper session invalidation. The flaw is identified as CWE-1464. It has a CVSS 3.1 base score of 6.8, indicating a medium severity impact with high confidentiality and integrity impact but no availability impact.

JetBrains Datalore versions before 2026.4 contain a vulnerability where account tokens lack proper expiration validation. This flaw allows an attacker to establish a new authenticated session using expired tokens. The issue is classified under CWE-672, indicating operations on resources after expiration or release. The vulnerability has a high severity with a CVSS score of 7.4 and affects versions prior to 2026.4. JetBrains has fixed this issue in version 2026.4.

CVE-2026-123281 is a high-severity vulnerability in JetBrains Datalore before version 2026.4. It involves argument injection (CWE-88) that allows notebook code to execute commands in the sidecar container via the mount broker. This flaw is fixed in version 2026.4.

CVE-2026-123280 is an incorrect authorization vulnerability in JetBrains Datalore versions before 2026.2.4. It allows unauthenticated users to execute code via published interactive reports. The issue is fixed in version 2026.2.4.

CVE-2026-123279 is a critical authorization vulnerability in JetBrains Datalore before version 2026.4. It allows view-only collaborators to execute code within a notebook's computation environment. This flaw is due to incorrect authorization checks (CWE-863) that fail to properly restrict code execution privileges. The vulnerability has been fixed in version 2026.4.

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

Ericsson CodeChecker versions prior to 6.29.3 have a session management vulnerability where logout does not fully invalidate session tokens when multiple API worker processes are used. Each worker maintains its own in-memory session cache, so tokens remain valid in other workers until expiration. This allows an attacker with a captured token to impersonate a user after logout.

Red Hat has released security updates for the Red Hat build of Keycloak 26.6.8 images used in OpenShift Container Platform. These updates address multiple vulnerabilities including account takeover, privilege escalation, denial of service, path traversal, injection flaws, and authentication bypasses. The fixes cover a wide range of security issues affecting authentication, authorization, token handling, cryptographic verification, and denial of service vectors. The advisory aligns the containerized Keycloak images with the standalone product release and is intended for on-premise or private cloud deployments.