Skip to content
OpenAdvisories

Vendor

JetBrains

545 known vulnerabilities.

JetBrains at a glance

Last 12 months
270
Critical · all time
24
Exploited · all time
4
Public exploit · all time
10

4 of the exploited vulnerabilities are known to be used by ransomware (CISA).

New vulnerabilities per month · last 12 months
0 50 100 December 2025: 12 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 7 vulnerabilities, 1 critical March 2026: 2 vulnerabilities Mar April 2026: 3 vulnerabilities May 2026: 22 vulnerabilities June 2026: 11 vulnerabilities, 3 critical Jun July 2026: 27 vulnerabilities, 6 critical August 2026: 18 vulnerabilities, 1 critical September 2026: 57 vulnerabilities, 2 critical Sep October 2026: 22 vulnerabilities, 2 critical November 2026: 89 vulnerabilities, 4 critical
Show as table
MonthVulnerabilitiesCritical
Nov 2026894
Oct 2026222
Sep 2026572
Aug 2026181
Jul 2026276
Jun 2026113
May 2026220
Apr 202630
Mar 202620
Feb 202671
Jan 202600
Dec 2025120
Nov 202580
Oct 202500
Sep 202540
Aug 2025100
Jul 2025130
Jun 202550
May 202560
Apr 2025100
Mar 202560
Feb 202520
Jan 202570
Dec 2024150

Products

TeamCity 191 YouTrack 141 IntelliJ IDEA 94 Hub 25 Datalore 19 Ktor 14 WebStorm 10 PyCharm 10 Toolbox App 10 Rider 9 GoLand 9 PhpStorm 8 CLion 7 Junie CLI 4 RubyMine 4 DataGrip 3 RustRover 3 Junie 3 ReSharper 2 DataSpell 2 Junie GitHub Action 2 dotTrace 1 ETW Host Service 1 ReSharper, Rider and dotTrace 1 Kotlin 1 IDE Services 1 Exposed 1 Runtime 1 JetBrains Gateway 1 Aqua 1 MPS 1 TeamCity < 2023.05.4 0 IntelliJ IDEA < 2023.1 0 TeamCity < 2023.05.3 0 TeamCity < 2023.05 0 IntelliJ IDEA < 2022.2.4 0 IntelliJ IDEA < 2022.3 0 TeamCity < 2023.11.1 0 PhpStorm < 2023.1 0 IntelliJ IDEA < 2022.3.1 0

Latest advisories

  • Medium max 7.5
    WID-SEC-2026-4393 2 CVEs

    JetBrains Toolbox App: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JetBrains Toolbox App ausnutzen, um beliebigen Programmcode auszuführen oder Informationen offenzulegen.

    JetBrains Linux Windows macOS
  • Medium max 5.5
    WID-SEC-2026-4396 1 CVE

    JetBrains PyCharm: Schwachstelle ermöglicht Codeausführung

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in JetBrains PyCharm ausnutzen, um beliebigen Programmcode auszuführen.

    JetBrains Linux Windows
  • Low max 4.4
    WID-SEC-2026-4397 2 CVEs

    JetBrains PhpStorm: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JetBrains PhpStorm ausnutzen, um Informationen offenzulegen und Dateien zu manipulieren.

    JetBrains Linux Windows macOS
  • Medium max 7.8
    WID-SEC-2026-4398 15 CVEs

    JetBrains IntelliJ IDEA: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in JetBrains IntelliJ IDEA ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

    JetBrains Linux Windows
  • Low max 3.5
    WID-SEC-2026-4399 1 CVE

    JetBrains You Track: Schwachstelle ermöglicht Darstellen falscher Informationen

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in JetBrains You Track ausnutzen, um falsche Informationen darzustellen.

    JetBrains Linux Windows
All Critical High Medium Low Exploited only Public exploit

545 results · Feed

  • Medium 4.4
    CVE-2026-123858

    In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted…

    JetBrains PhpStorm
  • Medium 6.5
    CVE-2026-123856

    In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development se…

    JetBrains Toolbox App
  • Medium 4.3
    CVE-2026-123857

    In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

    JetBrains PhpStorm
  • High 7.5
    CVE-2026-123855

    In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

    JetBrains Toolbox App
  • Medium 5.5
    CVE-2026-123854

    In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

    JetBrains PyCharm
  • High 7.8
    CVE-2026-123853

    In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM …

    JetBrains IntelliJ IDEA
  • Medium 5.4
    CVE-2026-123851

    In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

    JetBrains Junie GitHub Action
  • High 7.4
    CVE-2026-123852

    In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

    JetBrains Junie GitHub Action
  • High 7.0
    CVE-2026-123849

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watch…

    JetBrains IntelliJ IDEA
  • Low 3.5
    CVE-2026-123850

    In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

    JetBrains YouTrack
  • High 7.4
    CVE-2026-123848

    In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates

    JetBrains IntelliJ IDEA
  • Medium 5.3
    CVE-2026-123847

    In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command comp…

    JetBrains IntelliJ IDEA
  • Low 3.3
    CVE-2026-123845

    In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

    JetBrains IntelliJ IDEA
  • Medium 4.3
    CVE-2026-123846

    In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

    JetBrains IntelliJ IDEA
  • Low 3.3
    CVE-2026-123843

    In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

    JetBrains IntelliJ IDEA
  • Medium 5.3
    CVE-2026-123844

    In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

    JetBrains IntelliJ IDEA
  • High 7.8
    CVE-2026-123841

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive

    JetBrains IntelliJ IDEA
  • High 7.1
    CVE-2026-123842

    In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives

    JetBrains IntelliJ IDEA
  • Medium 4.7
    CVE-2026-123839

    In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Develo…

    JetBrains IntelliJ IDEA
  • Medium 4.7
    CVE-2026-123840

    In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

    JetBrains IntelliJ IDEA
  • High 7.8
    CVE-2026-123838

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

    JetBrains IntelliJ IDEA
  • High 8.8
    CVE-2026-123836

    In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

    JetBrains Datalore
  • High 7.8
    CVE-2026-123837

    In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run …

    JetBrains IntelliJ IDEA
  • High 7.5
    CVE-2026-123834

    In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's servi…

    JetBrains Datalore
  • Medium 5.9
    CVE-2026-123835

    In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload…

    JetBrains Datalore
  • Critical 9.6
    CVE-2026-123832

    In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

    JetBrains CLion
  • Low 3.6
    CVE-2026-123833

    In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects

    JetBrains IntelliJ IDEA
  • Critical 9.6
    CVE-2026-123831

    In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

    JetBrains CLion
  • Low 3.1
    CVE-2026-123337

    In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility

    JetBrains YouTrack
  • Low 3.8
    CVE-2026-123334

    In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by an…

    JetBrains YouTrack
  • Low 3.5
    CVE-2026-123335

    In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to …

    JetBrains YouTrack
  • Low 3.1
    CVE-2026-123336

    In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion

    JetBrains YouTrack
  • Medium 4.7
    CVE-2026-123332

    In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server conf…

    JetBrains YouTrack
  • Low 3.8
    CVE-2026-123333

    In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between spri…

    JetBrains YouTrack
  • Medium 5.4
    CVE-2026-123329

    In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other pro…

    JetBrains YouTrack
  • Medium 5.4
    CVE-2026-123330

    In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue vis…

    JetBrains YouTrack
  • Medium 5.4
    CVE-2026-123331

    In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles

    JetBrains YouTrack
  • High 7.1
    CVE-2026-123326

    In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script discl…

    JetBrains YouTrack
  • High 7.5
    CVE-2026-123327

    In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue…

    JetBrains YouTrack
  • Medium 6.4
    CVE-2026-123328

    In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab

    JetBrains YouTrack