Jetbrains Intellij_idea
63 CVEs affecting Jetbrains Intellij_idea. Latest disclosed: 2026-07-10. Critical: 8, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45977 | Critical | 9.8 | 2022-02-25 | JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 202… |
CVE-2020-11690 | Critical | 9.8 | 2020-04-22 | In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. |
CVE-2019-9873 | Critical | 9.8 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server cred… |
CVE-2019-9823 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server… |
CVE-2019-9186 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configu… |
CVE-2019-10104 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting… |
CVE-2026-59792 | Critical | 9.6 | 2026-07-10 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible |
CVE-2024-37051 | Critical | 9.3 | 2024-06-10 | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202… |
CVE-2022-28651 | High | 8.4 | 2022-04-05 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields |
CVE-2019-9872 | High | 8.1 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted reco… |
CVE-2026-49367 | High | 8.0 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account |
CVE-2026-49366 | High | 7.8 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion |
CVE-2022-24346 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. |
CVE-2022-24345 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible. |
CVE-2021-29263 | High | 7.8 | 2021-05-11 | In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS. |
CVE-2021-25758 | High | 7.8 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution. |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2021-30504 | High | 7.5 | 2021-05-11 | In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. |
CVE-2021-30006 | High | 7.5 | 2021-05-11 | In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure. |
CVE-2020-7914 | High | 7.5 | 2020-01-31 | In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 201… |