II
Product
IntelliJ IDEA
82
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 11High 38Medium 23Low 10
Watch
Add IntelliJ IDEA to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-29815 | 6.7 | Apr 28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible Affected: before 2022.1 |
| CVE-2022-29813 | 6.7 | Apr 28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible Affected: before 2022.1 |
| CVE-2025-57728 | 6.5 | Aug 20 | In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files Affected: before 2025.2 |
| CVE-2026-75054 | 6.3 | Aug 17 | In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects Affected: before 2026.2.1 |
| CVE-2026-75057 | 6.2 | Aug 17 | In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log Affected: before 2026.1.5 |
| CVE-2026-64810 | 6.1 | Jul 23 | In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking Affected: before 2026.2 |
| CVE-2024-46970 | 6.1 | Sep 16 | In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible Affected: before 2024.1.0 |
| CVE-2022-29817 | 6.1 | Apr 28 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible Affected: before 2022.1 |
| CVE-2019-14954 | 5.9 | Oct 1 | JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection Affected: before 2019.2 |
| CVE-2026-75058 | 5.5 | Aug 17 | In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers Affected: before 2026.2.1 |
| CVE-2026-75055 | 5.5 | Aug 17 | In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE Affected: before 2026.2.1 |
| CVE-2022-46827 | 5.5 | Dec 8 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible Affected: before 2022.3 |
| CVE-2022-46826 | 5.5 | Dec 8 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability Affected: before 2022.3 |
| CVE-2022-28651 | 5.5 | Apr 5 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields Affected: before 2021.3.3 |
| CVE-2026-75053 | 5.4 | Aug 17 | In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint Affected: before 2026.2.1 |
| CVE-2025-68269 | 5.4 | Dec 16 | In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH Affected: before 2025.3 |
| CVE-2024-24941 | 5.3 | Feb 6 | In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL Affected: before 2023.3.3 |
| CVE-2021-25756 | 5.3 | Feb 3 | In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS Affected: before 2020.2 |
| CVE-2020-27622 | 5.3 | Nov 16 | In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version Affected: before 2020.2 |
| CVE-2019-18361 | 5.3 | Oct 31 | JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution Affected: before 2019.2 |
| CVE-2025-57730 | 4.6 | Aug 20 | In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature Affected: before 2025.2.0 |
| CVE-2026-75052 | 4.4 | Aug 17 | In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects Affected: before 2026.2.1 |
| CVE-2024-24940 | 4.3 | Feb 6 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives Affected: before 2023.3.3 |
Showing 23