Security Vulnerabilities
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
CVSS Score
7.8
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives
CVSS Score
7.1
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
CVSS Score
3.3
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
CVSS Score
3.6
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
CVSS Score
6.1
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects
CVSS Score
5.4
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible
CVSS Score
5.3
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 sSRF was possible via annotations.xml files during indexing
CVSS Score
3.3
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
CVSS Score
3.3
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
CVSS Score
3.1
EPSS Score
0.002
Published
2026-11-06