Security Vulnerabilities
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling
CVSS Score
8.4
EPSS Score
0.001
Published
2026-07-23
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
CVSS Score
8.4
EPSS Score
0.001
Published
2026-07-23
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
CVSS Score
4.3
EPSS Score
0.002
Published
2026-07-23
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
CVSS Score
7.8
EPSS Score
0.001
Published
2026-07-23
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
CVSS Score
10.0
EPSS Score
0.004
Published
2026-07-23
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
CVSS Score
10.0
EPSS Score
0.004
Published
2026-07-23
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
CVSS Score
3.5
EPSS Score
0.004
Published
2026-07-23
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
CVSS Score
7.8
EPSS Score
0.001
Published
2026-07-23
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
CVSS Score
7.8
EPSS Score
0.001
Published
2026-07-23
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
CVSS Score
5.3
EPSS Score
0.002
Published
2026-07-23