CVE Intelligence

Jetbrains vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Jetbrains products: 189 record(s), with severity, exploitation and fixes.

Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1

Exploited only (KEV) →

CVE-2026-49368 Medium · 5.4 CWE-79 May 29, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
CVE-2026-49367 High · 8.8 CWE-862 May 29, 2026
Missing Authorization in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
CVE-2026-49366 High · 7.8 CWE-78 May 29, 2026
OS Command Injection in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
CVE-2026-44413 High · 7.5 CWE-306 May 11, 2026
Missing Authentication for Critical Function in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
CVE-2026-41882 High · 7.5 CWE-59 Apr 30, 2026
Link Following in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server
CVE-2026-41153 Critical · 9.8 CWE-77 Apr 17, 2026
Command Injection in Jetbrains Junie
In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
CVE-2026-33392 High · 7.2 CWE-1336 Apr 17, 2026
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via…
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
CVE-2026-32745 Medium · 5.7 CWE-319 Mar 13, 2026
Cleartext Transmission of Sensitive Information in Jetbrains Datalore
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
CVE-2026-32229 Medium · 6.8 CWE-290 Mar 11, 2026
Authentication Bypass by Spoofing in Jetbrains Hub
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
CVE-2026-28196 Low · 2.3 CWE-459 Feb 25, 2026
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials…
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
CVE-2026-28195 Medium · 4.3 CWE-862 Feb 25, 2026
Missing Authorization in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
CVE-2026-28194 Medium · 6.1 CWE-601 Feb 25, 2026
Open Redirect in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
CVE-2026-28193 Medium · 5.3 CWE-862 Feb 25, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
CVE-2026-25848 Critical · 9.8 CWE-306 Feb 9, 2026
JetBrains Hub Authentication Bypass (CWE-306)
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
CVE-2026-25847 Medium · 6.1 CWE-79 Feb 9, 2026
Cross-site Scripting (XSS) in Jetbrains Pycharm
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
CVE-2026-25846 Medium · 6.5 CWE-532 Feb 9, 2026
Insertion of Sensitive Information into Log File in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
CVE-2025-68269 Medium · 5.4 CWE-349 Dec 16, 2025
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of…
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
CVE-2025-68268 Medium · 6.1 CWE-79 Dec 16, 2025
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
CVE-2025-68267 Medium · 6.5 CWE-272 Dec 16, 2025
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing…
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
CVE-2025-68166 Medium · 6.1 CWE-79 Dec 16, 2025
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
CVE-2025-68165 Medium · 6.1 CWE-79 Dec 16, 2025
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
CVE-2025-68164 Low · 2.7 CWE-203 Dec 16, 2025
Observable Discrepancy in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
CVE-2025-68163 Medium · 4.8 CWE-79 Dec 16, 2025
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
CVE-2025-68162 Low · 2.7 CWE-829 Dec 16, 2025
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via…
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
CVE-2025-67742 High · 7.5 CWE-22 Dec 11, 2025
Path Traversal in Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload