Jetbrains - vulnerabilities (CVEs)

697 CVEs in 44 products, 48 in the last 30 days, newest from 2026-10-27.

Products

• Teamcity - 283 CVEs
• Youtrack - 157 CVEs
• Intellij Idea - 77 CVEs
• Hub - 37 CVEs
• Ktor - 21 CVEs
• Pycharm - 12 CVEs
• Toolbox - 11 CVEs
• Rider - 9 CVEs
• Webstorm - 9 CVEs
• Goland - 8 CVEs
• Kotlin - 7 CVEs
• Phpstorm - 6 CVEs
• Toolbox App - 6 CVEs
• Youtrack Mobile - 6 CVEs
• Upsource - 5 CVEs
• Resharper - 4 CVEs
• Rubymine - 4 CVEs
• Code With Me - 3 CVEs
• Junie - 3 CVEs
• Space - 3 CVEs
• Clion - 2 CVEs
• Datalore - 2 CVEs
• Dottrace - 2 CVEs
• Junie Cli - 2 CVEs
• Mps - 2 CVEs
• Aqua - 1 CVEs
• Datagrip - 1 CVEs
• Dataspell - 1 CVEs
• Dotpeek - 1 CVEs
• Etw Host Service - 1 CVEs
• Exposed - 1 CVEs
• Ide Services - 1 CVEs
• Ideavim - 1 CVEs
• Idetalk - 1 CVEs
• Jetbrains Gateway - 1 CVEs
• Resharper Ultimate - 1 CVEs
• Rider And Dottrace - 1 CVEs
• Runtime - 1 CVEs
• Rustrover - 1 CVEs
• Scala - 1 CVEs
• Vim - 1 CVEs
• Youtrack Integration - 1 CVEs
• Gateway - 0 CVEs
• Omea Reader - 0 CVEs

Newest CVEs of Jetbrains

• CVE-2026-117530 - CVSS 6.7 (medium), 2026-10-27: In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
• CVE-2026-111096 - CVSS 6.7 (medium), 2026-10-15: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
• CVE-2026-111095 - CVSS 8 (high), 2026-10-15: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
• CVE-2026-111093 - CVSS 7.5 (high), 2026-10-15: In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
• CVE-2026-111094 - CVSS 9.8 (critical), 2026-10-15: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
• CVE-2026-111092 - CVSS 6.5 (medium), 2026-10-15: In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
• CVE-2026-111091 - CVSS 7.8 (high), 2026-10-15: In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
• CVE-2026-108474 - CVSS 9.8 (critical), 2026-10-09: In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
• CVE-2026-106219 - CVSS 7.5 (high), 2026-10-06: In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
• CVE-2026-106218 - CVSS 10 (critical), 2026-10-06: In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
• CVE-2026-103497 - CVSS 5.5 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
• CVE-2026-103496 - CVSS 5.4 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
• CVE-2026-103495 - CVSS 4.3 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
• CVE-2026-103494 - CVSS 6.6 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
• CVE-2026-103493 - CVSS 8.1 (high), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
• CVE-2026-103492 - CVSS 6.5 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
• CVE-2026-103491 - CVSS 6.5 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
• CVE-2026-103490 - CVSS 7.2 (high), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
• CVE-2026-103489 - CVSS 5.4 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
• CVE-2026-103488 - CVSS 7.1 (high), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
• CVE-2026-100280 - CVSS 4.3 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
• CVE-2026-100278 - CVSS 4.9 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
• CVE-2026-100277 - CVSS 9.8 (critical), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
• CVE-2026-100279 - CVSS 6.5 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
• CVE-2026-100275 - CVSS 6.9 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
• CVE-2026-100276 - CVSS 7.5 (high), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
• CVE-2026-100274 - CVSS 6.5 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
• CVE-2026-100273 - CVSS 9.8 (critical), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
• CVE-2026-100272 - CVSS 4.9 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
• CVE-2026-100271 - CVSS 2.7 (low), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects