First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-123844

MediumCVSS 5.3/10Last modified Nov 10, 2026

Description

In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
JetBrains	IntelliJ IDEA	< 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory

Timeline

Published: Nov 6, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1238453.3In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects CVE-2026-1238464.3In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation CVE-2026-1238475.3In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion CVE-2026-1238487.4In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates CVE-2026-1238497.0In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers CVE-2026-123854.3The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via t CVE-2026-1238503.5In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives CVE-2026-1238515.4In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters CVE-2026-1238527.4In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates CVE-2026-1238537.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build CVE-2026-1238545.5In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module CVE-2026-1238557.5In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

CVE-2026-123844: Medium severity, CVSS 5.3 | Vulnix