Jetbrains

602 CVEs across 44 Jetbrains products. Browse Jetbrains vulnerabilities, severities, and proof-of-concept exploits.

Jetbrains products with known CVEs

ProductCVEs
Teamcity276
Youtrack117
Intellij Idea69
Intellij Idea49
Hub36
Ktor21
Toolbox11
Pycharm10
Rider9
Webstorm9
Goland8
Kotlin7
Phpstorm6
Toolbox App6
Youtrack Mobile6
Upsource5
Resharper4
Rubymine4
Code With Me3
Junie3
Space3
Clion2
Dottrace2
Mps2
Aqua1
Datagrip1
Datalore1
Dataspell1
Dotpeek1
Etw Host Service1
Etw Host Service1
Ideavim1
Ide Services1
Ide Services1
Idetalk1
Jetbrains Gateway1
Jetbrains Gateway1
Resharper, Rider And Dottrace1
Resharper Ultimate1
Runtime1
Rustrover1
Scala1
Vim1
Youtrack Integration1
Jetbrains CVEs — newest first (page 1 of 7)
CVESeverityScorePublishedSummary
CVE-2026-63077Critical9.82026-07-27In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-65908High8.62026-07-23In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open
CVE-2026-65907Critical9.12026-07-23In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
CVE-2026-65906High8.82026-07-23In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVE-2026-64815High8.12026-07-23In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CVE-2026-64814High8.62026-07-23In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
CVE-2026-64813Critical10.02026-07-23In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
CVE-2026-64812Critical10.02026-07-23In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
CVE-2026-64811High7.82026-07-23In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
CVE-2026-64810Medium4.32026-07-23In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
CVE-2026-64809High8.42026-07-23In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
CVE-2026-64808High8.42026-07-23In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling
CVE-2026-64807High7.82026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
CVE-2026-64806High8.42026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter
CVE-2026-64805High8.42026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling
CVE-2026-64804High8.42026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
CVE-2026-64803High7.82026-07-23In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
CVE-2026-64802High7.82026-07-23In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
CVE-2026-64800Low3.52026-07-23In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
CVE-2026-62422Critical10.02026-07-14In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database…
CVE-2026-61492Low3.52026-07-10In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
CVE-2026-59796High8.12026-07-10In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
CVE-2026-59795High8.12026-07-10In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
CVE-2026-59794High7.32026-07-10In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
CVE-2026-59793High8.82026-07-10In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
CVE-2026-59792Critical9.62026-07-10In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
CVE-2026-59791Low3.52026-07-10In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
CVE-2026-57926Low2.62026-06-26In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
CVE-2026-57925Medium4.32026-06-26In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVE-2026-57924Medium4.32026-06-26In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVE-2026-57923Medium5.32026-06-26In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
CVE-2026-57922Low3.12026-06-26In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVE-2026-57921Medium4.32026-06-26In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVE-2026-53914Medium6.72026-06-26In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
CVE-2026-56142Critical9.92026-06-19In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authenticatio…
CVE-2026-56141Critical9.82026-06-19In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes…
CVE-2026-53915High7.12026-06-19In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration
CVE-2026-50242Critical10.02026-06-19In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database acces…
CVE-2026-49386Medium6.52026-05-29In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
CVE-2026-49385Medium6.52026-05-29In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
CVE-2026-49384Medium6.12026-05-29In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
CVE-2026-49383Low3.32026-05-29In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
CVE-2026-49382Medium4.52026-05-29In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
CVE-2026-49381Low3.42026-05-29In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
CVE-2026-49380Low3.12026-05-29In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
CVE-2026-49379Medium6.52026-05-29In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
CVE-2026-49378Medium4.32026-05-29In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
CVE-2026-49377Medium4.32026-05-29In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
CVE-2026-49376Medium6.52026-05-29In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
CVE-2026-49375Medium6.12026-05-29In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
CVE-2026-49374High7.62026-05-29In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
CVE-2026-49373High7.12026-05-29In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
CVE-2026-49372High7.52026-05-29In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
CVE-2026-49371High7.12026-05-29In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
CVE-2026-49370Low3.42026-05-29In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
CVE-2026-49369Medium4.32026-05-29In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
CVE-2026-49368High8.72026-05-29In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
CVE-2026-49367High8.02026-05-29In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
CVE-2026-49366High7.82026-05-29In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
CVE-2026-44413High8.22026-05-11In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
CVE-2026-41882High7.42026-04-30In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web serv…
CVE-2026-41153Medium5.82026-04-17In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
CVE-2026-33392High7.22026-04-17In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
CVE-2026-32745Medium6.32026-03-13In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
CVE-2026-32229Medium6.82026-03-11In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
CVE-2026-28196Low2.32026-02-25In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
CVE-2026-28195Medium4.32026-02-25In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
CVE-2026-28194Medium4.32026-02-25In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
CVE-2026-28193High8.82026-02-25In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
CVE-2026-25848Critical9.12026-02-09In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
CVE-2026-25847High8.22026-02-09In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
CVE-2026-25846Medium6.52026-02-09In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
CVE-2025-68269Medium5.42025-12-16In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
CVE-2025-68268Medium5.42025-12-16In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
CVE-2025-68267Medium6.52025-12-16In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
CVE-2025-68166Medium5.42025-12-16In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
CVE-2025-68165Medium5.42025-12-16In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
CVE-2025-68164Low2.72025-12-16In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
CVE-2025-68163Low3.52025-12-16In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
CVE-2025-68162Low2.72025-12-16In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
CVE-2025-67742Low3.82025-12-11In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
CVE-2025-67741Medium4.62025-12-11In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
CVE-2025-67740Low2.72025-12-11In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
CVE-2025-67739Low3.12025-12-11In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
CVE-2025-64773Low2.72025-11-11In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
CVE-2025-64685High8.12025-11-10In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
CVE-2025-64684Medium4.32025-11-10In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form
CVE-2025-64683Medium5.32025-11-10In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
CVE-2025-64682Low2.72025-11-10In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
CVE-2025-64681Low2.72025-11-10In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
CVE-2025-64457Medium4.22025-11-10In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
CVE-2025-64456High8.42025-11-10In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation
CVE-2025-59458High8.32025-09-17In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 2…
CVE-2025-59457High7.72025-09-17In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows
CVE-2025-59456Medium5.52025-09-17In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload
CVE-2025-59455Medium4.22025-09-17In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
CVE-2025-58335Medium5.52025-08-28In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 2…
CVE-2025-58334High8.12025-08-28In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves
CVE-2025-57734Medium4.32025-08-20In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
CVE-2025-57733Medium5.52025-08-20In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content