Threat database

CVE-2026-123852 is a high-severity vulnerability in JetBrains Junie GitHub Action versions before 1.8.0. It involves incorrect authorization (CWE-863) that allows code execution with workflow credentials via fork updates. The issue is fixed in version 1.8.0.

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

CVE-2026-123849 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in untrusted projects via the Terraform File Watchers feature. The flaw is classified under CWE-829, which involves inclusion of functionality from an untrusted control sphere. This vulnerability has been fixed in version 2026.3.

CVE-2026-123848 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 where host name verification was missing for server TLS certificates. This improper validation of certificates (CWE-297) could allow an attacker to present a TLS certificate that does not match the server's host name, potentially enabling man-in-the-middle attacks. The issue has been fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion

In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

CVE-2026-123842 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.3 that allows arbitrary file write via symbolic links when extracting plugin archives. This flaw is due to improper handling of symlinks during plugin extraction. The issue is fixed in version 2026.3.

CVE-2026-123841 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 that allows code execution via symbolic links in an imported settings archive. This flaw is related to improper handling of symlinks (CWE-59) during the import process. The vulnerability has a high severity with a CVSS score of 7.8 and was fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model

CVE-2026-123838 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via a UI Designer form file due to inclusion of functionality from an untrusted control sphere (CWE-829). This flaw is fixed in version 2026.3.

CVE-2026-123837 is an OS command injection vulnerability in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.1. The flaw allows command injection via Tomcat run configurations on Windows Subsystem for Linux (WSL) when working with untrusted projects. This vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. A fix is available in version 2026.3.

CVE-2026-123836 is a vulnerability in JetBrains Datalore before version 2026.4 that allows workspace collaborators to obtain the owner's SSH private key via Git backup due to improper link following (CWE-59). This flaw has a high severity with a CVSS score of 8.8. The issue is fixed in version 2026.4.

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

CVE-2026-123834 is a high-severity vulnerability in JetBrains Datalore before version 2026.4. It involves improper scope validation in database tasks, which allows an attacker to use another workspace's service account. This flaw is categorized as an authorization bypass through a user-controlled key (CWE-639).

In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects