CVEs
Browse the synced catalog, newest first.
- CVE-2026-123856In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development serverJetBrains Toolbox App
- CVE-2026-123855In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLsJetBrains Toolbox App
- CVE-2026-123854In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget moduleJetBrains PyCharm
- CVE-2026-123853In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the…JetBrains IntelliJ IDEA
- CVE-2026-123852In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updatesJetBrains Junie GitHub Action
- CVE-2026-123851In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded charactersJetBrains Junie GitHub Action
- CVE-2026-123850In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directivesJetBrains YouTrack
- CVE-2026-123849In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File WatchersJetBrains IntelliJ IDEA
- CVE-2026-123848In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificatesJetBrains IntelliJ IDEA
- CVE-2026-123847In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completionJetBrains IntelliJ IDEA
- CVE-2026-123846In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validationJetBrains IntelliJ IDEA
- CVE-2026-123845In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projectsJetBrains IntelliJ IDEA
- CVE-2026-123844In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositoriesJetBrains IntelliJ IDEA
- CVE-2026-123843In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configurationJetBrains IntelliJ IDEA
- CVE-2026-123842In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archivesJetBrains IntelliJ IDEA
- CVE-2026-123841In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archiveJetBrains IntelliJ IDEA
- CVE-2026-123840In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsJetBrains IntelliJ IDEA
- CVE-2026-123839In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port…JetBrains IntelliJ IDEA
- CVE-2026-123838In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form fileJetBrains IntelliJ IDEA
- CVE-2026-123837In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSLJetBrains IntelliJ IDEA
- CVE-2026-123836In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backupJetBrains Datalore
- CVE-2026-123835In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionJetBrains Datalore
- CVE-2026-123834In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service accountJetBrains Datalore
- CVE-2026-123833In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projectsJetBrains IntelliJ IDEA
- CVE-2026-123832In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation databaseJetBrains CLion
- CVE-2026-123831In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settingsJetBrains CLion
- CVE-2026-49951RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameterinfiniflow ragflow
- CVE-2026-121623Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server Filesensiolabs symfony/serializer
- CVE-2026-80301Avast sandbox escape via unpreserved COM pathway through Task SchedulerGen Digital Avast Antivirus, Avast One, Avast Premium Se… +1
- CVE-2026-80302Avast sandbox escape via arbitrary file write in virtualized environmentGen Digital Avast Antivirus, Avast One, Avast Premium Se… +1