JetBrains Datalore vulnerabilities

2 CVEs affecting JetBrains Datalore, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111093, published 2026-10-15.

More from JetBrains.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-111093, published 2026-10-15. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
• CVE-2026-32745, published 2026-03-13. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings