← All security news
SecurityPatchHIGH

JetBrains fixes 61 flaws in nine tools, including IntelliJ IDEA, Hub, Datalore and YouTrack; two are critical

· 1 min read

JetBrains published security fixes for 61 CVEs on 6 November 2026, two of them critical (Hub and Datalore). IntelliJ IDEA gets 15 fixes, including code execution when opening an untrusted project. No exploitation is reported.

JetBrains IDEs, Hub, YouTrack

On 6 November 2026 JetBrains published a large batch of security fixes: 61 CVEs across nine tools, according to SecurityOnline — 2 critical, 20 high, 26 medium and 13 low. The products include IntelliJ IDEA, WebStorm, CLion, Hub, YouTrack, Datalore, Ktor, Junie CLI and the Toolbox App. No source reports exploitation in the wild or public exploit code.

The two critical flaws are in server products. CVE-2026-123294 (CVSS 9.6) in JetBrains Hub, the login and user-management service behind self-hosted YouTrack and other JetBrains servers: a logged-in user, even a low-privileged one, could escalate privileges by changing email details during the verification flow. It is fixed in Hub 2026.2.52556. CVE-2026-123279 (CVSS 9.0) in Datalore, JetBrains' data-science notebook platform, let view-only collaborators run code in a notebook's computation; it is fixed in Datalore 2026.4. Another Datalore flaw, CVE-2026-123280 (CVSS 8.1), let unauthenticated users run code through public reports, and a second Hub flaw, CVE-2026-123295 (CVSS 8.1), let users switch off enforced two-factor login.

For developers on the desktop: IntelliJ IDEA receives 15 fixes. The CVE record for CVE-2026-123302 (CVSS 7.8) says code execution was possible in untrusted projects via script engine discovery; it lists versions before 2026.3, 2026.2.4, 2026.1.5.1 and 2025.3.6.2 as affected. Other IntelliJ IDEA fixes cover cross-site scripting in OpenAPI handling (CVE-2026-123301, CVSS 8.2) and issues involving ShellCheck and Terraform paths. CLion (GDB profile handling), WebStorm and the Junie CLI coding agent (a command execution flaw, fixed in 26.8.24) are also patched.

Other fixes: YouTrack gets 15 fixes, including CVE-2026-123323 (CVSS 8.4), where weak URL checks let apps send REST requests without the user's consent. The Ktor web framework fixes session forgery through tampered cookies (CVE-2026-123317, CVSS 8.1) in 3.6.1. SecurityOnline gives YouTrack 2026.2.19728 as the fixed build, but lists 2026.2.19656 for CVE-2026-123323, so check JetBrains' own advisory list for your exact build.

More news

PHP
VulnerabilityCRITICALEXPLOITED IN THE WILD

CISA confirms PHP2Shell is exploited; US agencies must patch by 29 October

The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.

· CVE-2026-109618 · CVE-2026-109619
OpenSSH
VulnerabilityHIGHEXPLOITED IN THE WILD

SSHole is already being exploited: attackers tried the OpenSSH login bypass within nine hours and got root on an Alpine honeypot

Threat intelligence firm Previdian says attackers started using CVE-2026-123158 less than nine hours after it was published and got root on a honeypot running Alpine Linux and OpenSSH. Musl-based systems without PAM should install OpenSSH 10.6p2 and restart sshd, or turn off password logins.

· CVE-2026-123158
ChatGPT
VulnerabilityHIGH

ChatGPT's Lockdown Mode could be bypassed to leak chats: in the old desktop app, just talking to a malicious GPT was enough; OpenAI has fixed it

Check Point Research found that ChatGPT's HTML preview could open pop-ups that escaped its sandbox, getting around Lockdown Mode to leak chats, show fake login pages or push a fake update. OpenAI fixed it on 18 September 2026; no attacks in the wild are reported.