Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
88 results · Clear filters · Feed
-
Low 2.7
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
-
Low 3.5
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
-
Low 2.7
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
-
Low 3.8
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
-
Low 2.7
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
-
Low 3.1
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
-
Low 2.7
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
-
Low 2.7
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
-
Low 2.7
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
-
Low 3.7
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
-
Low 3.5CVE-2025-46618 EPSS 63%
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
-
Low 3.3
In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file
-
Low 2.7
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
-
Low 3.5
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
-
Low 3.7
In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import wi…
-
Low 3.1
In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query pa…
-
Low 3.5
In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings
-
Low 3.5
In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings
-
Low 3.3
In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible
-
Low 3.5
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page
-
Low 3.7
In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
-
Low 3.5
In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
-
Low 2.6
In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
-
Low 3.5
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
-
Low 3.5
In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible
-
Low 3.5
In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible
-
Low 2.8
In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
-
Low 3.3
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
-
Low 3.5
In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration
-
Low 3.5
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration
-
Low 3.3
In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases
-
Low 3.3
In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message
-
Low 3.3
In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was p…
-
Low 3.5
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
-
Low 2.7
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
-
Low 2.2
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
-
Low 3.2
In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
-
Low 3.6
In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was miss…
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible