First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-123276

HighCVSS 7.8/10Last modified Nov 7, 2026

Description

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
JetBrains	CLion	< 2026.3, 2026.2.4.1

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Timeline

Published: Nov 6, 2026
Last modified: Nov 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1232775.0In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux CVE-2026-1232786.7In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint CVE-2026-1232799.0In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators CVE-2026-123288.1Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these CVE-2026-1232808.1In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports CVE-2026-1232817.5In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker CVE-2026-1232827.4In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session CVE-2026-1232836.8In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account CVE-2026-1232846.5In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content CVE-2026-1232858.8In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection CVE-2026-1232866.5In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token CVE-2026-1232877.5In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

CVE-2026-123276: High severity, CVSS 7.8 | Vulnix