Security Vulnerabilities
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4,
2026.1.5.1,
2025.3.6.2 code execution was possible in untrusted projects via script engine discovery
CVSS Score
7.8
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
CVSS Score
7.8
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
CVSS Score
7.5
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
CVSS Score
7.4
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
CVSS Score
6.8
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
CVSS Score
6.3
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
CVSS Score
7.8
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
CVSS Score
6.7
EPSS Score
0.001
Published
2026-11-06
Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled output is checked only after Ghostscript has completed rendering, allowing resource consumption beyond the configured pixel limit. The amplification depends on the scale selected by the application, not an attacker-controlled scale value. This issue is fixed in version 13.0.0.
CVSS Score
6.3
EPSS Score
0.005
Published
2026-11-05
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.
CVSS Score
8.3
EPSS Score
0.005
Published
2026-11-05