EUVD-2026-118057

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid...

EUVD-2026-118053

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link...

EUVD-2026-118056

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook...

EUVD-2026-118055

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint...

EUVD-2026-118054

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files...

EUVD-2026-118050

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection...

EUVD-2026-118049

In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content...

EUVD-2026-118048

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...

EUVD-2026-118047

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session...

EUVD-2026-118045

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports...

EUVD-2026-118046

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker...

EUVD-2026-118052

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports...

EUVD-2026-118051

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token...

EUVD-2026-118044

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators...

CVE-2026-123292

In JetBrains Datalore versions prior to 2026.4 , a vulnerability exists where API tokens and sessions belonging to removed or banned users remain valid. This issue is categorized under CWE-1464: Improper Session Invalidation . The impact allows potentially unauthorized continued access through pe...

CVE-2026-123291

JetBrains Datalore versions prior to 2026.4 are vulnerable to an improper owner validation flaw (CWE-639). This security issue allows an attacker to read issues from another workspace and execute notebook runs. The vulnerability has a MEDIUM severity (CVSS 3.1 score of 4.3) and is accessible over...

CVE-2026-123290

In JetBrains Datalore versions prior to 2026.4 , hidden notebook code could be exposed to unauthenticated users . This vulnerability occurs via the public interactive report content endpoint , leading to the insertion of sensitive information into sent data (CWE-201). Exploitation details and spe...

CVE-2026-123289

In JetBrains Datalore versions prior to 2026.4 , an improper authorization vulnerability (CWE-863) allowed users with notebook viewer privileges to bypass intended restrictions and modify files . This flaw impacts the integrity and availability of the data within the platform. No specific exploit...

CVE-2026-123288

A stored Cross-Site Scripting (XSS) vulnerability exists in JetBrains Datalore versions prior to 2026.4 . The issue is triggered via a Vega editor link within notebook charts, leading to the execution of malicious scripts in the context of the victim's session. The vulnerability is associated wit...

CVE-2026-123287

In JetBrains Datalore versions prior to 2026.4 , a vulnerability exists where private notebook files can be downloaded without authentication. This issue is triggered through published interactive reports , leading to unauthorized access to private data. The root cause is identified as Incorrect ...