Security Vulnerabilities
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
CVSS Score
8.2
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4,
2026.1.5.1,
2025.3.6.2 code execution was possible in untrusted projects via script engine discovery
CVSS Score
7.8
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
CVSS Score
7.8
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
CVSS Score
7.5
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
CVSS Score
7.4
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
CVSS Score
6.8
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
CVSS Score
6.3
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
CVSS Score
7.8
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
CVSS Score
6.7
EPSS Score
0.001
Published
2026-11-06
Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled output is checked only after Ghostscript has completed rendering, allowing resource consumption beyond the configured pixel limit. The amplification depends on the scale selected by the application, not an attacker-controlled scale value. This issue is fixed in version 13.0.0.
CVSS Score
6.3
EPSS Score
0.005
Published
2026-11-05