cve.bz

jetbrains datalore vulnerabilities, newest first

Filter
  1. 8.8CVE-2026-123836EPSS 0.5%

    In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

  2. 5.9CVE-2026-123835EPSS 0.6%

    In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

  3. 7.5CVE-2026-123834EPSS 0.3%

    In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account

  4. 2.7CVE-2026-123292EPSS 0.3%

    In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

  5. 4.3CVE-2026-123291EPSS 0.2%

    In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

  6. 5.3CVE-2026-123290EPSS 0.3%

    In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

  7. 5.4CVE-2026-123289EPSS 0.3%

    In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

  8. 5.4CVE-2026-123288EPSS 0.6%

    In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

  9. 5.9CVE-2026-123287EPSS 0.3%

    In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

  10. 5.9CVE-2026-123286EPSS 0.2%

    In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

  11. 6.3CVE-2026-123285EPSS 0.9%

    In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

  12. 6.5CVE-2026-123284EPSS 0.3%

    In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content

  13. 6.8CVE-2026-123283EPSS 0.2%

    In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

  14. 7.4CVE-2026-123282EPSS 0.3%

    In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

  15. 7.5CVE-2026-123281EPSS 0.4%

    In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

  16. 8.1CVE-2026-123280EPSS 0.4%

    In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

  17. 9.0CVE-2026-123279EPSS 0.3%

    In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

  18. 7.5CVE-2026-111093EPSS 0.4%

    In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

  19. 5.7CVE-2026-32745EPSS 0.1%

    In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings