Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
545 results · Feed
-
Low 3.4
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
-
High 8.0
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
-
High 8.7
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
-
Medium 4.3
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
-
High 8.2
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
-
High 7.4
In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local file…
-
Medium 5.8
In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
-
High 7.2
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
-
Medium 6.3
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
-
Medium 6.8
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
-
Low 2.3
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
-
Medium 4.3
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build conf…
-
Medium 4.3
In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
-
High 8.8
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
-
Critical 9.1
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
-
High 8.2
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
-
Medium 6.5
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
-
Medium 5.4
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
-
Medium 5.4
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
-
Medium 6.5
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token i…
-
Medium 5.4
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
-
Medium 5.4
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
-
Low 2.7
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
-
Low 3.5
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
-
Low 2.7
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
-
Low 3.8
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
-
Medium 4.8
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
-
Low 2.7
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
-
Low 3.1
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
-
Low 2.7
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
-
Medium 4.2
In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
-
High 8.4
In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation
-
High 8.1
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
-
Medium 4.5
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form
-
Medium 5.3
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
-
Low 2.7
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
-
Low 2.7
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
-
High 8.3
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.5…
-
Medium 5.5CVE-2025-59456 EPSS 15%
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload