Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
545 results · Feed
-
Medium 6.3
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injec…
-
High 7.4
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
-
Medium 6.8
In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
-
High 8.1
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
-
High 7.5
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
-
Medium 6.7
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
-
Critical 9.0
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
-
High 7.8
In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug pr…
-
Medium 5.0
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session env…
-
Critical 9.0
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider…
-
High 8.0
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.…
-
Medium 6.7
In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted comman…
-
Medium 6.7
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
-
High 8.0
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
-
High 7.5
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbit…
-
High 8.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build mess…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to …
-
High 7.8
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
-
Critical 9.8
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
-
High 8.8
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
-
Medium 6.5
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on th…
-
Medium 5.5
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
-
High 8.1
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
-
Medium 6.6
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
-
High 7.2
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
-
Low 2.0
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
-
High 7.1
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to projec…
-
Low 3.1
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
-
High 8.9
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
-
Medium 6.9
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
-
Medium 5.9
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run t…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
-
High 8.2
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Ad…