Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
123 results · Clear filters · Feed
-
High 7.5
In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
-
High 7.6
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
-
High 7.1CVE-2026-49373 EPSS 33%
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
-
High 7.1
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
-
High 8.0
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
-
High 8.7
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
-
High 8.2
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
-
High 7.4
In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local file…
-
High 7.2
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
-
High 8.8
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
-
High 8.2
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
-
High 8.4
In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation
-
High 8.1
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
-
High 8.3
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.5…
-
High 7.7
In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows
-
High 8.1
In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-p…
-
High 7.5
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership
-
High 8.7
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
-
High 7.5
In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
-
High 7.7
In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
-
High 7.6
In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was poss…
-
High 7.7
In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API
-
High 8.3
In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces
-
High 8.3
In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible
-
High 7.7
In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources
-
High 7.8
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace…
-
High 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
-
High 8.0
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
-
High 8.1
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorize…
-
High 7.5
In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions
-
High 7.4
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
-
High 8.1
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific …
-
High 7.4
In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter
-
High 7.3
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
KEV Apr 20, 2026 -
High 8.6CVE-2023-45612 Public exploit
In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
-
High 7.5
In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms
-
High 7.5
In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
-
High 7.1
In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.
-
High 7.5
The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking