CVE-2026-123849

In JetBrains IntelliJ IDEA versions prior to 2026.3 , a vulnerability exists that allows code execution within untrusted projects. The root cause is located in the Terraform File Watchers component, specifically identified as an inclusion of functionality from an untrusted control sphere (CWE-829...

EUVD-2026-118352

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers...

CVE-2026-123841

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

EUVD-2026-118344

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-123841

In JetBrains IntelliJ IDEA versions prior to 2026.3 , a vulnerability exists where code execution is possible via symlinks located within an imported settings archive. The root cause is identified as Improper Link Resolution Before File Access (CWE-59). The vulnerability is rated as HIGH severity...

CVE-2026-123838

JetBrains IntelliJ IDEA versions prior to 2026.3 are affected by a vulnerability where code execution is possible in Safe Mode . The root cause involves the processing of a UI Designer form file , leading to the inclusion of functionality from an untrusted control sphere (CWE-829). This flaw allo...

EUVD-2026-118341

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file...

CVE-2026-123838

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file...

CVE-2026-123835

In JetBrains Datalore versions prior to 2026.4 , a Time-of-check Time-of-use (TOCTOU) race condition during an init script upload allows for code execution within another user's computation. No specific exploit links or remediation details are provided in the documents.

EUVD-2026-118338

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition...

CVE-2026-123835

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition...

EUVD-2026-118335

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database...

CVE-2026-123832

In JetBrains CLion versions prior to 2026.2 , a vulnerability allows for code execution within Safe Mode . The root cause involves the processing of a JSON compilation database . The impact is classified as CRITICAL (CVSS 9.6) with high consequences for confidentiality, integrity, and availabilit...

CVE-2026-123832

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database...

EUVD-2026-118334

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings...

CVE-2026-123831

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings...

CVE-2026-123831

JetBrains CLion versions before 2026.2 (specifically before 2026.1.4 ) are vulnerable to code execution in Safe Mode . The vulnerability is triggered via Meson project settings and is associated with CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The impact includes high leve...

Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at...

SCMKit

SCMKit Description S ource C ode M anagement Attack Toolkit - SCMKit is a toolkit that can be used to attack SCM systems. SCMKit allows the user to specify the SCM system and attack module to use, along with specifying valid credentials username/password or API key to the respective SCM system...

CVE-2026-80301

The Avast sandbox on Windows contains an improper isolation vulnerability that allows a local, low-privileged attacker to escape the sandbox environment. While the sandbox virtualizes the file system and registry, it fails to restrict COM interface access to the Task Scheduler service . An attack...