CVE-2026-117530

mediumpriority · track · 0

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 6.7 · medium

Is it mine?

0 products

Who says so?

— sources

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

cvss

Technical severity, 0–10. One row per scoring source.

6.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.7mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · cve@jetbrains.comexploitability 0.8 · impact 5.9

v3.16.1mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

The CWE weakness classes this flaw belongs to.

Products and version ranges known to be affected.

No affected products recorded.

Which sources assert this record, and when.

published 2026-10-27modified 2026-10-27

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-49869US	—OT critical	2.10% (82nd)	KEV	2026-06-26
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whiteli…
CVE-2024-5217US	critical9.8OT critical	99.6% (100th)	KEV	2024-07-10
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable a…
CVE-2012-0013US	high9.3	73.9% (99th)	Exploit	2012-01-10
Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R…
CVE-2017-7525US	critical9.8	37.7% (99th)	Exploit	2018-02-06
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by se…
CVE-2023-32571US	critical9.8	34.9% (98th)	Exploit	2023-06-22
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed…

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.