Priority MEDIUM 40
In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00472 · Published 2026-11-06 · Fixed in 2026.4 CWE-59
Priority LOW 29
In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00649 · Published 2026-11-06 · Fixed in 2026.4 CWE-367
Priority LOW 35
In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00298 · Published 2026-11-06 · Fixed in 2026.4 CWE-639
Priority LOW 13
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00292 · Published 2026-11-06 · Fixed in 2026.4 CWE-1464
Priority LOW 20
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.0025 · Published 2026-11-06 · Fixed in 2026.4 CWE-639
Priority LOW 30
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00318 · Published 2026-11-06 · Fixed in 2026.4 CWE-201
Priority LOW 24
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00265 · Published 2026-11-06 · Fixed in 2026.4 CWE-863
Priority LOW 25
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00584 · Published 2026-11-06 · Fixed in 2026.4 CWE-79
Priority LOW 26
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00291 · Published 2026-11-06 · Fixed in 2026.4 CWE-863
Priority LOW 26
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00179 · Published 2026-11-06 · Fixed in 2026.4 CWE-863
Priority LOW 29
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00287 · Published 2026-11-06 · Fixed in 2026.4 CWE-863
Priority LOW 29
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.00227 · Published 2026-11-06 · Fixed in 2026.4 CWE-1464
Priority LOW 32
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-11-06 · Fixed in 2026.4 CWE-672
Priority LOW 33
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00365 · Published 2026-11-06 · Fixed in 2026.4 CWE-88
Priority LOW 39
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.00312 · Published 2026-11-06 · Fixed in 2026.4 CWE-863
THREATIST.IORead the docs