VulnFeed.org: JetBrains IntelliJ IDEAhttps://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enCVE-2026-123304: In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathhttps://vulnfeed.org/cve/CVE-2026-123304/https://vulnfeed.org/cve/CVE-2026-123304/Fri, 06 Nov 2026 10:27:59 +0000In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathCVE-2026-123305: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote hosthttps://vulnfeed.org/cve/CVE-2026-123305/https://vulnfeed.org/cve/CVE-2026-123305/Fri, 06 Nov 2026 10:27:59 +0000In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote hostCVE-2026-123306: In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runshttps://vulnfeed.org/cve/CVE-2026-123306/https://vulnfeed.org/cve/CVE-2026-123306/Fri, 06 Nov 2026 10:27:59 +0000In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsCVE-2026-123301: In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possiblehttps://vulnfeed.org/cve/CVE-2026-123301/https://vulnfeed.org/cve/CVE-2026-123301/Fri, 06 Nov 2026 10:27:58 +0000In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possibleCVE-2026-123302: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovehttps://vulnfeed.org/cve/CVE-2026-123302/https://vulnfeed.org/cve/CVE-2026-123302/Fri, 06 Nov 2026 10:27:58 +0000In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discoveryCVE-2026-123293: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path settinghttps://vulnfeed.org/cve/CVE-2026-123293/https://vulnfeed.org/cve/CVE-2026-123293/Fri, 06 Nov 2026 10:27:54 +0000In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path settingCVE-2026-118696: In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2https://vulnfeed.org/cve/CVE-2026-118696/https://vulnfeed.org/cve/CVE-2026-118696/Fri, 30 Oct 2026 18:17:24 +0000In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates