Jetbrains vulnerabilities
Published CVEs affecting Jetbrains products: 189 record(s), with severity, exploitation and fixes.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-86478
Critical · 9.8
CWE-290 Sep 7, 2026
Authentication Bypass by Spoofing in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
CVE-2026-75060
High · 8.4
CWE-306 Aug 17, 2026
Missing Authentication for Critical Function in Jetbrains Pycharm
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
CVE-2026-75059
Medium · 4.4
CWE-79 Aug 17, 2026
Cross-site Scripting (XSS) in Jetbrains Pycharm
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
CVE-2026-75058
Medium · 5.5
CWE-611 Aug 17, 2026
XML External Entity (XXE) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
CVE-2026-75057
Medium · 6.2
CWE-532 Aug 17, 2026
Insertion of Sensitive Information into Log File in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
CVE-2026-75056
High · 7.8
CWE-78 Aug 17, 2026
OS Command Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
CVE-2026-75055
Medium · 5.5
CWE-611 Aug 17, 2026
XML External Entity (XXE) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
CVE-2026-75054
Medium · 6.3
CWE-918 Aug 17, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
CVE-2026-75053
Medium · 5.4
CWE-918 Aug 17, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
CVE-2026-75052
Medium · 4.4
CWE-77 Aug 17, 2026
Command Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
CVE-2026-75051
High · 8.1
CWE-862 Aug 17, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
CVE-2026-75050
Medium · 6.5
CWE-770 Aug 17, 2026
Allocation of Resources Without Limits or Throttling in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type parameters
CVE-2026-75049
Medium · 6.5
CWE-862 Aug 17, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
CVE-2026-75048
High · 8.2
CWE-79 Aug 17, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
CVE-2026-75047
Medium · 6.5
CWE-409 Aug 17, 2026
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression…
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
CVE-2026-75046
Medium · 4.3
CWE-862 Aug 17, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
CVE-2026-75045
Critical · 9.1
CWE-288 Aug 17, 2026
Authentication Bypass Using an Alternate Path or Channel in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
CVE-2026-75044
High · 8.1
CWE-862 Aug 17, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
CVE-2026-68762
Medium · 5.9
CWE-835 Aug 17, 2026
Infinite Loop in Jetbrains Ktor
In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible
CVE-2026-63077
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-502 Jul 27, 2026
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-65908
High · 8.6
CWE-829 Jul 23, 2026
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious…
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open
CVE-2026-65907
Critical · 9.1
CWE-94 Jul 23, 2026
Code Injection in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
CVE-2026-65906
Critical · 10.0
CWE-94 Jul 23, 2026
Code Injection in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVE-2026-64815
Critical · 9.8
CWE-94 Jul 23, 2026
Code Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CVE-2026-64814
High · 8.6
CWE-862 Jul 23, 2026
Missing Authorization in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session