Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
545 results · Feed
-
Medium 4.6
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
-
Low 3.7
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
-
High 8.8
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
-
Medium 5.4
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
-
High 8.0
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restrict…
-
Critical 9.8
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser pr…
-
Critical 9.8CVE-2026-86478 Public exploit
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthent…
-
Medium 4.4
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
-
High 8.4
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
-
Medium 5.5
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
-
Medium 6.2
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
-
Medium 5.5
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
-
Medium 6.3
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
-
High 8.1
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
-
Low 3.6
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trust…
-
Medium 5.4
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
-
High 7.1
In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other…
-
High 8.2
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
-
High 8.1
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated u…
-
Critical 9.1CVE-2026-75045 Public exploit
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download datab…
-
Medium 5.9
In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible
-
Critical 9.8
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polli…
KEV Aug 5, 2026 -
Critical 9.1
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
-
High 8.6
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on u…
-
High 8.8
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
-
High 8.1
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
-
High 8.6
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
-
Critical 10.0
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via develo…
-
Critical 10.0
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
-
Medium 4.3
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activ…
-
High 8.4
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configu…
-
High 8.4
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project too…
-
High 8.4
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configu…
-
High 7.8
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration