Jetbrains
71 known vulnerabilities
Top Products
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on un
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via develop
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activi
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configur
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tool
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configur
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-loca
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-loca
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 aut
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling w
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying pr
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment te
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privileg
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authenti
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service account
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
Frequently Asked Questions
How many CVEs affect Jetbrains?
Jetbrains has 71 CVE records in our database, including 9 critical and 30 high severity vulnerabilities. 1 of these are listed in CISA's Known Exploited Vulnerabilities catalog.
What are the most severe Jetbrains vulnerabilities?
Jetbrains has 9 critical severity (CVSS 9.0+) and 30 high severity (CVSS 7.0-8.9) vulnerabilities. 1 vulnerabilities are confirmed as actively exploited in the wild.
How can I scan for Jetbrains vulnerabilities?
CyberStrike's AI-powered security agents automatically detect vulnerabilities in Jetbrains products across your infrastructure. The platform provides continuous pentesting, DAST scanning, and real-time vulnerability monitoring with actionable remediation guidance.
Detect Jetbrains Vulnerabilities
CyberStrike scans your infrastructure for Jetbrains vulnerabilities and provides real-time remediation guidance.
Get Started