Datalore at a glance
- Last 12 months
- 19
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 17 | 1 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 1 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
19 results · Feed
-
High 8.8
In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup
-
High 7.5
In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's servi…
-
Medium 5.9
In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload…
-
Low 2.7
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
-
Medium 5.3
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactiv…
-
Medium 4.3
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs noteb…
-
Medium 5.4
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
-
Medium 5.4
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
-
Medium 5.9
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
-
Medium 5.9
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published int…
-
Medium 6.5
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify…
-
Medium 6.3
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injec…
-
High 7.4
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
-
Medium 6.8
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
-
High 8.1
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
-
High 7.5
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
-
Critical 9.0
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
-
High 7.5
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbit…
-
Medium 6.3
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings