Priority LOW 32
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers
CVSS 3.1HIGH 7.0· Local · No auth · User interaction · EPSS 0.00145 · Published 2026-11-06 · Fixed in 2026.3 CWE-829
Priority LOW 34
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00201 · Published 2026-11-06 · Fixed in 2026.3 CWE-297
Priority LOW 25
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion
CVSS 3.1MEDIUM 5.3· Local · No auth · User interaction · EPSS 0.00149 · Published 2026-11-06 · Fixed in 2026.3 CWE-150
Priority LOW 20
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00256 · Published 2026-11-06 · Fixed in 2026.3 CWE-918
Priority LOW 15
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
CVSS 3.1LOW 3.3· Local · No auth · User interaction · EPSS 0.00171 · Published 2026-11-06 · Fixed in 2026.3 CWE-23
Priority LOW 24
In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories
CVSS 3.1MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00273 · Published 2026-11-06 · Fixed in 2026.3 CWE-918
Priority LOW 15
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
CVSS 3.1LOW 3.3· Local · No auth · User interaction · EPSS 0.00146 · Published 2026-11-06 · Fixed in 2026.3 CWE-829
Priority LOW 30
In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00169 · Published 2026-11-06 · Fixed in 2026.3 CWE-59
Priority LOW 35
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00191 · Published 2026-11-06 · Fixed in 2026.3 CWE-59
Priority LOW 21
In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00199 · Published 2026-11-06 · Fixed in 2026.3 CWE-80
Priority LOW 21
In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00254 · Published 2026-11-06 · Fixed in 2026.3 CWE-357
Priority LOW 35
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00173 · Published 2026-11-06 · Fixed in 2026.3 CWE-829
Priority LOW 16
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
CVSS 3.1LOW 3.6· Local · No auth · User interaction · EPSS 0.00128 · Published 2026-11-06 · Fixed in 2026.3 CWE-829
Priority LOW 15
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
CVSS 3.1LOW 3.3· Local · No auth · User interaction · EPSS 0.00111 · Published 2026-11-06 · Fixed in 2026.3 CWE-829
Priority LOW 24
In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00172 · Published 2026-11-06 · Fixed in 2026.3 CWE-918
Priority LOW 29
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
CVSS 3.1MEDIUM 6.3· Local · No auth · User interaction · EPSS 0.00142 · Published 2026-11-06 · Fixed in 2026.3 CWE-829
Priority LOW 34
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00201 · Published 2026-11-06 · Fixed in 2026.3 CWE-295
Priority LOW 35
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.00336 · Published 2026-11-06 · Fixed in 2026.3 CWE-23
Priority LOW 35
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0019 · Published 2026-11-06 · Fixed in 2026.3 CWE-829
Priority LOW 35
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00266 · Published 2026-11-06 · Fixed in 2026.3 CWE-79
Priority LOW 31
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
CVSS 3.1MEDIUM 6.7· Local · Low privileges · User interaction · EPSS 0.00128 · Published 2026-11-06 · Fixed in 2026.3 CWE-306
THREATIST.IORead the docs