IntelliJ IDEA at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 30 | 0 |
| Oct 2026 | 2 | 1 |
| Sep 2026 | 6 | 0 |
| Aug 2026 | 7 | 0 |
| Jul 2026 | 7 | 3 |
| Jun 2026 | 0 | 0 |
| May 2026 | 4 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 4 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Latest advisories
-
Medium max 7.8WID-SEC-2026-4398 15 CVEs
JetBrains IntelliJ IDEA: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in JetBrains IntelliJ IDEA ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
-
High max 8.2
JetBrains IntelliJ IDEA: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JetBrains IntelliJ IDEA ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Informationen auszuspähen, Dateien zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder beliebigen Programmco…
first Nov 5, 2026 -
High max 8.0WID-SEC-2026-4279 1 CVE
JetBrains (IntelliJ IDEA , PyCharm, PhpStorm, WebStorm, CLion, DataGrip, DataSpell): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in JetBrains (IntelliJ IDEA , PyCharm, PhpStorm, WebStorm, CLion, DataGrip, DataSpell) ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
-
High max 9.0WID-SEC-2026-4280 1 CVE
JetBrains Toolbox App: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in JetBrains Toolbox App und JetBrains IntelliJ IDEA ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
-
Medium max 7.8WID-SEC-2026-3679 1 CVE
JetBrains IntelliJ IDEA: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in JetBrains IntelliJ IDEA ausnutzen, um beliebigen Programmcode auszuführen.
94 results · Feed
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM …
-
High 7.0
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watch…
-
High 7.4
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
-
Medium 5.3
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command comp…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
-
Medium 4.3
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
-
Medium 5.3
In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
-
High 7.1
In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives
-
Medium 4.7
In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Develo…
-
Medium 4.7
In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run …
-
Low 3.6
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
-
Low 3.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
-
Medium 5.3
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview w…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown prev…
-
Medium 5.4
In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories …
-
Medium 6.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configuratio…
-
Medium 6.3
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
-
High 7.5
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote…
-
High 7.4
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store dur…
-
High 8.2
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted pro…
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform …
-
Medium 6.7
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
-
Critical 9.0
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider…
-
High 8.0
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.…
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted proje…
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed h…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source U…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
-
Low 2.8
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
-
High 8.4
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code e…
-
Medium 5.5
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
-
Medium 6.2
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log