Jetbrains vulnerabilities
Published CVEs affecting Jetbrains products: 189 record(s), with severity, exploitation and fixes.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-64813
Critical · 10.0
CWE-602 Jul 23, 2026
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible…
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
CVE-2026-64812
Critical · 10.0
CWE-306 Jul 23, 2026
Missing Authentication for Critical Function in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
CVE-2026-64811
High · 7.8
CWE-829 Jul 23, 2026
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before…
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
CVE-2026-64810
Medium · 6.1
CWE-79 Jul 23, 2026
Cross-site Scripting (XSS) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
CVE-2026-64809
High · 8.4
CWE-829 Jul 23, 2026
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before…
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
CVE-2026-64808
High · 8.4
CWE-829 Jul 23, 2026
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before…
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling
CVE-2026-64807
High · 7.8
CWE-829 Jul 23, 2026
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a…
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
CVE-2026-64806
High · 8.4
CWE-829 Jul 23, 2026
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before…
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter
CVE-2026-64805
High · 8.4
CWE-829 Jul 23, 2026
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before…
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling
CVE-2026-64804
High · 8.4
CWE-829 Jul 23, 2026
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before…
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
CVE-2026-64803
High · 7.8
CWE-94 Jul 23, 2026
Code Injection in Jetbrains Goland
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
CVE-2026-64802
High · 7.8
CWE-94 Jul 23, 2026
Code Injection in Jetbrains Goland
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
CVE-2026-64800
Medium · 5.7
CWE-532 Jul 23, 2026
Insertion of Sensitive Information into Log File in Jetbrains Goland
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
CVE-2026-62422
Critical · 9.8
CWE-306 Jul 14, 2026
Missing Authentication for Critical Function in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVE-2026-61492
Medium · 6.1
CWE-79 Jul 10, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
CVE-2026-59796
High · 8.1
CWE-862 Jul 10, 2026
Missing Authorization in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
CVE-2026-59795
Medium · 6.1
CWE-79 Jul 10, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
CVE-2026-59794
Medium · 5.4
CWE-79 Jul 10, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
CVE-2026-59793
High · 8.8
CWE-73 Jul 10, 2026
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the…
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
CVE-2026-59792
Critical · 9.8
CWE-23 Jul 10, 2026
Relative Path Traversal in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible
CVE-2026-59791
Low · 3.5
CWE-1021 Jul 10, 2026
Clickjacking in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
CVE-2026-57926
Critical · 9.8
CWE-1321 Jun 26, 2026
JetBrains YouTrack Prototype Pollution in websandbox Bridge
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
CVE-2026-57925
Medium · 5.3
CWE-862 Jun 26, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVE-2026-57924
Medium · 5.3
CWE-276 Jun 26, 2026
Incorrect Default Permissions in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVE-2026-57923
High · 7.5
CWE-862 Jun 26, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings