Security Vulnerabilities
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
CVSS Score
5.9
EPSS Score
0.002
Published
2026-11-06
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
CVSS Score
5.9
EPSS Score
0.003
Published
2026-11-06
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
CVSS Score
5.4
EPSS Score
0.006
Published
2026-11-06
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
CVSS Score
5.4
EPSS Score
0.003
Published
2026-11-06
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
CVSS Score
5.3
EPSS Score
0.003
Published
2026-11-06
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
CVSS Score
4.3
EPSS Score
0.003
Published
2026-11-06
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
CVSS Score
2.7
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
CVSS Score
6.7
EPSS Score
0.001
Published
2026-11-06
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
CVSS Score
6.3
EPSS Score
0.009
Published
2026-11-06
Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled output is checked only after Ghostscript has completed rendering, allowing resource consumption beyond the configured pixel limit. The amplification depends on the scale selected by the application, not an attacker-controlled scale value. This issue is fixed in version 13.0.0.
CVSS Score
6.3
EPSS Score
0.005
Published
2026-11-05