CVE-2026-49383

LowCVSS 3.3/10Last modified Jul 22, 2026

Description

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
JetBrainsIntelliJ IDEA< 2026.1

References

Timeline

Published
May 29, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-493846.1In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possibleCVE-2026-493856.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accountsCVE-2026-493866.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning CanvasCVE-2026-493915.1Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before CVE-2026-493925.3Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::gCVE-2026-493938.4OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP CVE-2026-493947.1Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in WorkspCVE-2026-493967.1Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14,CVE-2026-493975.3Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14,CVE-2026-494003.3October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMaCVE-2026-494018.4Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrCVE-2026-494028.1Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShell
CVE-2026-49383: Low severity, CVSS 3.3 | Vulnix