CVE-2026-118696

HighCVSS 8.0/10Last modified Oct 31, 2026

Description

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-299

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
JetBrainsIntelliJ IDEA>= 2026.2, < 2026.2.4; >= 2026.1, < 2026.1.5.1; < 2025.3.6.2
JetBrainsPyCharm>= 2026.2, < 2026.2.4; >= 2026.1, < 2026.1.5.1; < 2025.3.6.2
JetBrainsPhpStorm>= 2026.2, < 2026.2.4; >= 2026.1, < 2026.1.5.1; < 2025.3.6.2
JetBrainsRubyMine>= 2026.2, < 2026.2.4; >= 2026.1, < 2026.1.5.1; < 2025.3.6.2
JetBrainsWebStorm>= 2026.2, < 2026.2.4; >= 2026.1, < 2026.1.5.1; < 2025.3.6.2
JetBrainsGoLand>= 2026.2, < 2026.2.4; >= 2026.1, < 2026.1.5.1; < 2025.3.5.2
JetBrainsRider>= 2026.2, < 2026.2.4; >= 2026.1, < 2026.1.5.3; < 2025.3.5.3
JetBrainsCLion>= 2026.2, < 2026.2.4.1; >= 2026.1, < 2026.1.5.2; < 2025.3.6.3
JetBrainsDataGrip>= 2026.2, < 2026.2.6.1; >= 2026.1, < 2026.1.4.1; < 2025.3.6.1
JetBrainsRustRover>= 2026.2, < 2026.2.5; >= 2026.1, < 2026.1.4.1; < 2025.3.7.1
JetBrainsDataSpell>= 2026.1, < 2026.1.3.1; < 2025.3.3.1

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 31, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1186979.0In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 20CVE-2026-1186986.5The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroCVE-2026-11876.4The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcodeCVE-2026-118705.4The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy beforeCVE-2026-1187008.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187018.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187028.8Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187038.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187048.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187058.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187068.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187078.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118696: High severity, CVSS 8.0 | Vulnix