CWE-829: Untrusted Functionality Inclusion vulnerabilities

Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-123858 is a vulnerability in JetBrains PhpStorm before version 2026.3 where project files from untrusted projects could be automatically uploaded to a deployment server. This behavior could lead to unintended information disclosure or modification. The issue is fixed in version 2026.3.

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

CVE-2026-123843 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.3 where untrusted projects could cause changes to the GPG agent configuration. This flaw involves inclusion of functionality from an untrusted control sphere, classified under CWE-829. The issue has a low severity rating and a CVSS score of 3.3. It was fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

CVE-2026-123833 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 where database connections could be established within untrusted projects. This flaw involves the inclusion of functionality from an untrusted control sphere, potentially allowing unintended database access. The issue has a low severity rating and a CVSS score of 3.6. JetBrains fixed this vulnerability in version 2026.3.

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings

In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects