CVE-2026-65906
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVSS
8.8
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 23 jul 2026 · Última mod.: 23 jul 2026 · CWE-94
Sin historial EPSS suficiente todavía.
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-4766810.0 CRÍ—
———DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.4hCVE-2026-659079.1 CRÍ—
———In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible7hCVE-2026-648158.1 ALT—
——0In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files7hCVE-2026-648037.8 ALT—
——0In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK7hCVE-2026-648027.8 ALT—
——0In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration7hCVE-2026-595439.9 CRÍ—
——0Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.7h