CVE-2026-123853

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process...

CVE-2026-123853

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process...

CVE-2026-123853

JetBrains IntelliJ IDEA versions prior to 2026.3 and 2026.2.2 are vulnerable to code execution while running in Safe Mode . The root cause involves project-controlled JVM options within the build process, which allows for the inclusion of functionality from an untrusted control sphere (CWE-829 )....

EUVD-2026-118356

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process...

CVE-2026-123285

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection...

CVE-2026-123285

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection...

EUVD-2026-118050

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection...

CVE-2026-123285

In JetBrains Datalore versions prior to 2026.3 , a vulnerability exists that allows for command execution within the database task container. This is caused by a JVM options injection flaw, which is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The vulnera...

CVE-2026-123285: JetBrains Datalore: In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options…

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection...

CVE-2026-123853: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process...

PYSEC-2026-3749

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

UBUNTU-CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

CVE-2022-37027

This CVE affects Ahsay AhsayCBS 9.1.4.0. An authenticated system user who can modify the Runtime Options in the web interface can inject arbitrary Java JVM options, which take effect after a restart. In the documented scenario, this can enable JMX services and lead to remote code execution as the...

CVE-2022-37027

Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and...

CVE-2021-41619: Improper Control of Generation of Code

An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface available to administrators allows specifying arbitrary Java Virtual Machine startup options. Some of the...

ZAP 2.4.2 - Penetration Testing Tool for Testing Web Applications

The Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testin...