Vulnerabilidades de Jetbrains
CVEs publicadas que afetam produtos de Jetbrains: 189 registro(s), com severidade, exploração e correções.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-86478
Crítica · 9.8
CWE-290 07/09/2026
Authentication Bypass by Spoofing em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
CVE-2026-75060
Alta · 8.4
CWE-306 17/08/2026
Missing Authentication for Critical Function em Jetbrains Pycharm
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
CVE-2026-75059
Média · 4.4
CWE-79 17/08/2026
Cross-site Scripting (XSS) em Jetbrains Pycharm
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
CVE-2026-75058
Média · 5.5
CWE-611 17/08/2026
XML External Entity (XXE) em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
CVE-2026-75057
Média · 6.2
CWE-532 17/08/2026
Insertion of Sensitive Information into Log File em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
CVE-2026-75056
Alta · 7.8
CWE-78 17/08/2026
OS Command Injection em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
CVE-2026-75055
Média · 5.5
CWE-611 17/08/2026
XML External Entity (XXE) em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
CVE-2026-75054
Média · 6.3
CWE-918 17/08/2026
Server-Side Request Forgery (SSRF) em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
CVE-2026-75053
Média · 5.4
CWE-918 17/08/2026
Server-Side Request Forgery (SSRF) em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
CVE-2026-75052
Média · 4.4
CWE-77 17/08/2026
Command Injection em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
CVE-2026-75051
Alta · 8.1
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
CVE-2026-75050
Média · 6.5
CWE-770 17/08/2026
Allocation of Resources Without Limits or Throttling em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type parameters
CVE-2026-75049
Média · 6.5
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
CVE-2026-75048
Alta · 8.2
CWE-79 17/08/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
CVE-2026-75047
Média · 6.5
CWE-409 17/08/2026
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression…
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
CVE-2026-75046
Média · 4.3
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
CVE-2026-75045
Crítica · 9.1
CWE-288 17/08/2026
Authentication Bypass Using an Alternate Path or Channel em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
CVE-2026-75044
Alta · 8.1
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
CVE-2026-68762
Média · 5.9
CWE-835 17/08/2026
Infinite Loop em Jetbrains Ktor
In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible
CVE-2026-63077
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-502 27/07/2026
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-65908
Alta · 8.6
CWE-829 23/07/2026
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious…
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open
CVE-2026-65907
Crítica · 9.1
CWE-94 23/07/2026
Code Injection em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
CVE-2026-65906
Crítica · 10.0
CWE-94 23/07/2026
Code Injection em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVE-2026-64815
Crítica · 9.8
CWE-94 23/07/2026
Code Injection em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CVE-2026-64814
Alta · 8.6
CWE-862 23/07/2026
Missing Authorization em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session