Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
308 results · Clear filters · Feed
-
Medium 5.4
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
-
Medium 5.9
In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible
-
Medium 4.3
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activ…
-
Medium 6.7
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
-
Medium 5.3
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying p…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment t…
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles…
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accoun…
-
Medium 6.1
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
-
Medium 4.5
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
-
Medium 4.3
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
-
Medium 6.5
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
-
Medium 4.3
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
-
Medium 6.1
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
-
Medium 6.5
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
-
Medium 4.3
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
-
Medium 5.8
In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
-
Medium 6.3
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
-
Medium 6.8
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
-
Medium 4.3
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build conf…
-
Medium 4.3
In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
-
Medium 6.5
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
-
Medium 5.4
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
-
Medium 5.4
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
-
Medium 6.5
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token i…
-
Medium 5.4
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
-
Medium 5.4
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
-
Medium 4.8
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
-
Medium 4.2
In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
-
Medium 4.5
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form
-
Medium 5.3
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
-
Medium 5.5CVE-2025-59456 EPSS 15%
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload
-
Medium 4.2
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
-
Medium 5.5
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.5…
-
Medium 4.3
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files