{"schema_version":1,"title":"Jetbrains Datalore vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 16 vulnerabilities in Jetbrains Datalore: 16 in the last 7 days and 16 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123836, was published on 6 November 2026. 16 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0.","url":"https://junglewise.ai/threats/technologies/datalore","json_url":"https://junglewise.ai/threats/technologies/datalore.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/datalore","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":5,"all_time":16,"critical":1,"exploited":0,"last_7_days":16,"last_30_days":16,"last_90_days":16,"last_365_days":16},"latest":[{"cve":"CVE-2026-123836","cvss":8.8,"slug":"cve-2026-123836-in-jetbrains-datalore-before-2026-4-workspace-collaborators","title":"JetBrains Datalore SSH private key exposure in Git backup","severity":"high","exploited":false,"published_at":"2026-11-06T17:17:21.963+00:00","url":"https://junglewise.ai/threats/cve-2026-123836-in-jetbrains-datalore-before-2026-4-workspace-collaborators"},{"cve":"CVE-2026-123835","cvss":5.9,"slug":"cve-2026-123835-in-jetbrains-datalore-before-2026-4-code-execution-was-possible","title":"JetBrains Datalore code execution via init script race condition","severity":"medium","exploited":false,"published_at":"2026-11-06T17:17:21.823+00:00","url":"https://junglewise.ai/threats/cve-2026-123835-in-jetbrains-datalore-before-2026-4-code-execution-was-possible"},{"cve":"CVE-2026-123834","cvss":7.5,"slug":"cve-2026-123834-in-jetbrains-datalore-before-2026-4-improper-scope-validation-in","title":"JetBrains Datalore improper scope validation in database tasks","severity":"high","exploited":false,"published_at":"2026-11-06T17:17:21.68+00:00","url":"https://junglewise.ai/threats/cve-2026-123834-in-jetbrains-datalore-before-2026-4-improper-scope-validation-in"},{"cve":"CVE-2026-123291","cvss":4.3,"slug":"cve-2026-123291-in-jetbrains-datalore-before-2026-4-improper-owner-validation","title":"JetBrains Datalore improper owner validation allowing workspace data access","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:07.73+00:00","url":"https://junglewise.ai/threats/cve-2026-123291-in-jetbrains-datalore-before-2026-4-improper-owner-validation"},{"cve":"CVE-2026-123290","cvss":5.3,"slug":"cve-2026-123290-in-jetbrains-datalore-before-2026-4-hidden-notebook-code-was","title":"JetBrains Datalore information disclosure in public report endpoint","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:07.583+00:00","url":"https://junglewise.ai/threats/cve-2026-123290-in-jetbrains-datalore-before-2026-4-hidden-notebook-code-was"},{"cve":"CVE-2026-123289","cvss":5.4,"slug":"cve-2026-123289-in-jetbrains-datalore-before-2026-4-improper-authorisation","title":"JetBrains Datalore improper authorization in notebook access control","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:07.44+00:00","url":"https://junglewise.ai/threats/cve-2026-123289-in-jetbrains-datalore-before-2026-4-improper-authorisation"},{"cve":"CVE-2026-123288","cvss":5.4,"slug":"cve-2026-123288-in-jetbrains-datalore-before-2026-4-stored-xss-in-notebook","title":"JetBrains Datalore stored XSS in notebook charts via Vega editor","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:07.31+00:00","url":"https://junglewise.ai/threats/cve-2026-123288-in-jetbrains-datalore-before-2026-4-stored-xss-in-notebook"},{"cve":"CVE-2026-123287","cvss":5.9,"slug":"cve-2026-123287-in-jetbrains-datalore-before-2026-4-private-notebook-files-could","title":"JetBrains Datalore authentication bypass in notebook export","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:07.177+00:00","url":"https://junglewise.ai/threats/cve-2026-123287-in-jetbrains-datalore-before-2026-4-private-notebook-files-could"},{"cve":"CVE-2026-123286","cvss":5.9,"slug":"cve-2026-123286-in-jetbrains-datalore-before-2026-4-improper-authorisation","title":"JetBrains Datalore improper authorization in file storage session handling","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:07.047+00:00","url":"https://junglewise.ai/threats/cve-2026-123286-in-jetbrains-datalore-before-2026-4-improper-authorisation"},{"cve":"CVE-2026-123285","cvss":6.3,"slug":"cve-2026-123285-in-jetbrains-datalore-before-2026-3-command-execution-was","title":"JetBrains Datalore command execution via JVM options injection","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:06.907+00:00","url":"https://junglewise.ai/threats/cve-2026-123285-in-jetbrains-datalore-before-2026-3-command-execution-was"},{"cve":"CVE-2026-123284","cvss":6.5,"slug":"cve-2026-123284-in-jetbrains-datalore-before-2026-4-improper-authorisation-on","title":"JetBrains Datalore improper authorization on workspace moves","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:06.773+00:00","url":"https://junglewise.ai/threats/cve-2026-123284-in-jetbrains-datalore-before-2026-4-improper-authorisation-on"},{"cve":"CVE-2026-123283","cvss":6.8,"slug":"cve-2026-123283-in-jetbrains-datalore-before-2026-4-account-takeover-was","title":"JetBrains Datalore account takeover in SSO sign-in","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:06.65+00:00","url":"https://junglewise.ai/threats/cve-2026-123283-in-jetbrains-datalore-before-2026-4-account-takeover-was"},{"cve":"CVE-2026-123282","cvss":7.4,"slug":"cve-2026-123282-in-jetbrains-datalore-before-2026-4-missing-expiration","title":"JetBrains Datalore missing token expiration validation","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:06.52+00:00","url":"https://junglewise.ai/threats/cve-2026-123282-in-jetbrains-datalore-before-2026-4-missing-expiration"},{"cve":"CVE-2026-123281","cvss":7.5,"slug":"cve-2026-123281-in-jetbrains-datalore-before-2026-4-notebook-code-could-execute","title":"JetBrains Datalore code execution in sidecar container via mount broker","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:06.39+00:00","url":"https://junglewise.ai/threats/cve-2026-123281-in-jetbrains-datalore-before-2026-4-notebook-code-could-execute"},{"cve":"CVE-2026-123280","cvss":8.1,"slug":"cve-2026-123280-in-jetbrains-datalore-before-2026-2-4-unauthenticated-users","title":"JetBrains Datalore unauthenticated code execution via published reports","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:06.27+00:00","url":"https://junglewise.ai/threats/cve-2026-123280-in-jetbrains-datalore-before-2026-2-4-unauthenticated-users"},{"cve":"CVE-2026-123279","cvss":9,"slug":"cve-2026-123279-in-jetbrains-datalore-before-2026-4-code-execution-was-possible","title":"JetBrains Datalore code execution in notebook computation","severity":"critical","exploited":false,"published_at":"2026-11-06T11:17:06.14+00:00","url":"https://junglewise.ai/threats/cve-2026-123279-in-jetbrains-datalore-before-2026-4-code-execution-was-possible"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":1,"exploited":0,"vulnerabilities":16},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Jetbrains YouTrack","slug":"youtrack","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/youtrack"},{"name":"Jetbrains IntelliJ IDEA","slug":"intellij-idea","vulnerabilities":51,"url":"https://junglewise.ai/threats/technologies/intellij-idea"},{"name":"Jetbrains TeamCity","slug":"teamcity","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/teamcity"},{"name":"Jetbrains Hub","slug":"hub","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/hub"},{"name":"Jetbrains Webstorm","slug":"webstorm","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/webstorm"},{"name":"Jetbrains GoLand","slug":"goland","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/goland"},{"name":"Jetbrains PyCharm","slug":"pycharm","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/pycharm"},{"name":"Jetbrains CLion","slug":"clion","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/clion"},{"name":"Jetbrains PhpStorm","slug":"phpstorm","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/phpstorm"},{"name":"Jetbrains Rider","slug":"rider","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/rider"},{"name":"Jetbrains Toolbox App","slug":"toolbox-app","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/toolbox-app"},{"name":"Jetbrains Junie CLI","slug":"junie-cli","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/junie-cli"}],"technology":{"hub":true,"name":"Jetbrains Datalore","slug":"datalore","vendor":{"hub":true,"name":"Jetbrains","slug":"jetbrains","url":"https://junglewise.ai/threats/vendors/jetbrains"},"aliases":[],"category":"web","homepage":"https://datalore.jetbrains.com","description":"JetBrains web-based data science and analytics platform for exploratory data analysis and notebook-style programming.","url":"https://junglewise.ai/threats/technologies/datalore"},"most_severe":[{"cve":"CVE-2026-123279","cvss":9,"slug":"cve-2026-123279-in-jetbrains-datalore-before-2026-4-code-execution-was-possible","title":"JetBrains Datalore code execution in notebook computation","severity":"critical","exploited":false,"published_at":"2026-11-06T11:17:06.14+00:00","url":"https://junglewise.ai/threats/cve-2026-123279-in-jetbrains-datalore-before-2026-4-code-execution-was-possible"},{"cve":"CVE-2026-123836","cvss":8.8,"slug":"cve-2026-123836-in-jetbrains-datalore-before-2026-4-workspace-collaborators","title":"JetBrains Datalore SSH private key exposure in Git backup","severity":"high","exploited":false,"published_at":"2026-11-06T17:17:21.963+00:00","url":"https://junglewise.ai/threats/cve-2026-123836-in-jetbrains-datalore-before-2026-4-workspace-collaborators"},{"cve":"CVE-2026-123280","cvss":8.1,"slug":"cve-2026-123280-in-jetbrains-datalore-before-2026-2-4-unauthenticated-users","title":"JetBrains Datalore unauthenticated code execution via published reports","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:06.27+00:00","url":"https://junglewise.ai/threats/cve-2026-123280-in-jetbrains-datalore-before-2026-2-4-unauthenticated-users"},{"cve":"CVE-2026-123834","cvss":7.5,"slug":"cve-2026-123834-in-jetbrains-datalore-before-2026-4-improper-scope-validation-in","title":"JetBrains Datalore improper scope validation in database tasks","severity":"high","exploited":false,"published_at":"2026-11-06T17:17:21.68+00:00","url":"https://junglewise.ai/threats/cve-2026-123834-in-jetbrains-datalore-before-2026-4-improper-scope-validation-in"},{"cve":"CVE-2026-123281","cvss":7.5,"slug":"cve-2026-123281-in-jetbrains-datalore-before-2026-4-notebook-code-could-execute","title":"JetBrains Datalore code execution in sidecar container via mount broker","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:06.39+00:00","url":"https://junglewise.ai/threats/cve-2026-123281-in-jetbrains-datalore-before-2026-4-notebook-code-could-execute"},{"cve":"CVE-2026-123282","cvss":7.4,"slug":"cve-2026-123282-in-jetbrains-datalore-before-2026-4-missing-expiration","title":"JetBrains Datalore missing token expiration validation","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:06.52+00:00","url":"https://junglewise.ai/threats/cve-2026-123282-in-jetbrains-datalore-before-2026-4-missing-expiration"},{"cve":"CVE-2026-123283","cvss":6.8,"slug":"cve-2026-123283-in-jetbrains-datalore-before-2026-4-account-takeover-was","title":"JetBrains Datalore account takeover in SSO sign-in","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:06.65+00:00","url":"https://junglewise.ai/threats/cve-2026-123283-in-jetbrains-datalore-before-2026-4-account-takeover-was"},{"cve":"CVE-2026-123284","cvss":6.5,"slug":"cve-2026-123284-in-jetbrains-datalore-before-2026-4-improper-authorisation-on","title":"JetBrains Datalore improper authorization on workspace moves","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:06.773+00:00","url":"https://junglewise.ai/threats/cve-2026-123284-in-jetbrains-datalore-before-2026-4-improper-authorisation-on"},{"cve":"CVE-2026-123285","cvss":6.3,"slug":"cve-2026-123285-in-jetbrains-datalore-before-2026-3-command-execution-was","title":"JetBrains Datalore command execution via JVM options injection","severity":"medium","exploited":false,"published_at":"2026-11-06T11:17:06.907+00:00","url":"https://junglewise.ai/threats/cve-2026-123285-in-jetbrains-datalore-before-2026-3-command-execution-was"},{"cve":"CVE-2026-123835","cvss":5.9,"slug":"cve-2026-123835-in-jetbrains-datalore-before-2026-4-code-execution-was-possible","title":"JetBrains Datalore code execution via init script race condition","severity":"medium","exploited":false,"published_at":"2026-11-06T17:17:21.823+00:00","url":"https://junglewise.ai/threats/cve-2026-123835-in-jetbrains-datalore-before-2026-4-code-execution-was-possible"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}