Skip to content
OpenAdvisories

Product · JetBrains

Datalore

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-123835

    In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload…

    JetBrains Datalore
  • Medium 5.3
    CVE-2026-123290

    In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactiv…

    JetBrains Datalore
  • Medium 4.3
    CVE-2026-123291

    In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs noteb…

    JetBrains Datalore
  • Medium 5.4
    CVE-2026-123288

    In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

    JetBrains Datalore
  • Medium 5.4
    CVE-2026-123289

    In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

    JetBrains Datalore
  • Medium 5.9
    CVE-2026-123286

    In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

    JetBrains Datalore
  • Medium 5.9
    CVE-2026-123287

    In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published int…

    JetBrains Datalore
  • Medium 6.5
    CVE-2026-123284

    In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify…

    JetBrains Datalore
  • Medium 6.3
    CVE-2026-123285

    In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injec…

    JetBrains Datalore
  • Medium 6.8
    CVE-2026-123283

    In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

    JetBrains Datalore
  • Medium 6.3
    CVE-2026-32745

    In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings

    JetBrains Datalore