CVE Intelligence

Jetbrains Intellij Idea vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Jetbrains Intellij Idea: 26 record(s), with affected versions and fixes.
cpe:2.3:a:jetbrains:intellij_idea

CVE-2026-100256 High · 7.8 CWE-829 Sep 30, 2026
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints…
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
CVE-2026-86505 Low · 3.3 CWE-201 Sep 7, 2026
Insertion of Sensitive Information Into Sent Data in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
CVE-2026-86504 High · 7.8 CWE-829 Sep 7, 2026
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before…
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution
CVE-2026-86503 Low · 3.3 CWE-918 Sep 7, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching
CVE-2026-86502 High · 8.4 CWE-306 Sep 7, 2026
Missing Authentication for Critical Function in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
CVE-2026-86501 Low · 2.8 CWE-532 Sep 7, 2026
Insertion of Sensitive Information into Log File in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
CVE-2026-75058 Medium · 5.5 CWE-611 Aug 17, 2026
XML External Entity (XXE) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
CVE-2026-75057 Medium · 6.2 CWE-532 Aug 17, 2026
Insertion of Sensitive Information into Log File in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
CVE-2026-75056 High · 7.8 CWE-78 Aug 17, 2026
OS Command Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
CVE-2026-75055 Medium · 5.5 CWE-611 Aug 17, 2026
XML External Entity (XXE) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
CVE-2026-75054 Medium · 6.3 CWE-918 Aug 17, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
CVE-2026-75053 Medium · 5.4 CWE-918 Aug 17, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
CVE-2026-75052 Medium · 4.4 CWE-77 Aug 17, 2026
Command Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
CVE-2026-64815 Critical · 9.8 CWE-94 Jul 23, 2026
Code Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CVE-2026-64814 High · 8.6 CWE-862 Jul 23, 2026
Missing Authorization in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
CVE-2026-64813 Critical · 10.0 CWE-602 Jul 23, 2026
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible…
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
CVE-2026-64812 Critical · 10.0 CWE-306 Jul 23, 2026
Missing Authentication for Critical Function in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
CVE-2026-64811 High · 7.8 CWE-829 Jul 23, 2026
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before…
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
CVE-2026-64810 Medium · 6.1 CWE-79 Jul 23, 2026
Cross-site Scripting (XSS) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
CVE-2026-59792 Critical · 9.8 CWE-23 Jul 10, 2026
Relative Path Traversal in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
CVE-2026-49383 Low · 3.3 CWE-611 May 29, 2026
XML External Entity (XXE) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
CVE-2026-49382 High · 7.8 CWE-1336 May 29, 2026
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template…
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
CVE-2026-49367 High · 8.8 CWE-862 May 29, 2026
Missing Authorization in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
CVE-2026-49366 High · 7.8 CWE-78 May 29, 2026
OS Command Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
CVE-2026-41882 High · 7.5 CWE-59 Apr 30, 2026
Link Following in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server