Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
83 results · page 1 of 2
Sep 30, 2026In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projectsCVE-2026-100256 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains MarketplaceCVE-2026-86505 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code executionCVE-2026-86504 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetchingCVE-2026-86503 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hostsCVE-2026-86502 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.4
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.logCVE-2026-86501 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.8
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importersCVE-2026-75058 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE logCVE-2026-75057 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.2
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possibleCVE-2026-75056 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXECVE-2026-75055 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projectsCVE-2026-75054 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpointCVE-2026-75053 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projectsCVE-2026-75052 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.6
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form filesCVE-2026-64815 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development sessionCVE-2026-64814 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.6
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionCVE-2026-64813 · Other software · JetBrains · reported by cve@jetbrains.comCritical 10
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development sessionCVE-2026-64812 · Other software · JetBrains · reported by cve@jetbrains.comCritical 10
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configurationCVE-2026-64811 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity trackingCVE-2026-64810 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possibleCVE-2026-59792 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.6
In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possibleCVE-2026-49383 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright pluginCVE-2026-49382 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.5
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user accountCVE-2026-49367 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completionCVE-2026-49366 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web serveCVE-2026-41882 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSHCVE-2025-68269 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development featureCVE-2025-57730 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.2
In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server startCVE-2025-57729 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden filesCVE-2025-57728 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote referenceCVE-2025-57727 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.7
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log fileCVE-2025-32054 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possibleCVE-2024-46970 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024CVE-2024-37051 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.3
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comjetbrains.com
Feb 6, 2024In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URLCVE-2024-24941 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Feb 6, 2024In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archivesCVE-2024-24940 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.8
In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 21, 2023In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project confCVE-2023-51655 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 26, 2023In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissionsCVE-2023-39261 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.2
In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 12, 2023In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain casesCVE-2023-38069 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 29, 2023In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.CVE-2022-48433 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 29, 2023In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.CVE-2022-48432 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.2
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 29, 2023In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.CVE-2022-48431 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.5
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 29, 2023In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.CVE-2022-48430 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 22, 2022In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.CVE-2022-47896 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 22, 2022In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.CVE-2022-47895 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.7
In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 8, 2022In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.CVE-2022-46828 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.2
In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 8, 2022In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.CVE-2022-46827 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.9
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 8, 2022In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.CVE-2022-46826 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.2
In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 8, 2022In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.CVE-2022-46825 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4
In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 8, 2022In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.CVE-2022-46824 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.6
In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Sep 19, 2022The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingCVE-2022-40978 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.