JE
Vendor
JetBrains
723
CVEs
4
On KEV
48
New 30D
Products
YO9.8
YouTrack
JetBrains
180 CVEs0 on KEV33 new
TE10.0
TeamCity
DevOps
284 CVEs4 on KEV8 new
II10.0
IntelliJ IDEA
JetBrains
82 CVEs0 on KEV1 new
HU9.8
Hub
JetBrains
38 CVEs0 on KEV1 new
EX9.8
Exposed
JetBrains
1 CVEs0 on KEV1 new
JC7.8
Junie CLI
JetBrains
2 CVEs0 on KEV2 new
RI7.8
Rider
JetBrains
9 CVEs0 on KEV1 new
DA7.5
Datalore
JetBrains
2 CVEs0 on KEV1 new
KT9.8
Ktor
JetBrains
22 CVEs0 on KEV0 new
PY9.8
PyCharm
JetBrains
12 CVEs0 on KEV0 new
TO9.8
Toolbox
Jetbrains
11 CVEs0 on KEV0 new
GO9.8
GoLand
JetBrains
9 CVEs0 on KEV0 new
WE9.8
WebStorm
JetBrains
9 CVEs0 on KEV0 new
KO9.8
Kotlin
JetBrains
7 CVEs0 on KEV0 new
PH9.8
PhpStorm
JetBrains
6 CVEs0 on KEV0 new
YM7.3
Youtrack Mobile
Jetbrains
6 CVEs0 on KEV0 new
UP9.8
Upsource
Jetbrains
5 CVEs0 on KEV0 new
RE7.8
Resharper
Jetbrains
4 CVEs0 on KEV0 new
RU9.8
Rubymine
Jetbrains
4 CVEs0 on KEV0 new
CW8.8
Code With ME
Jetbrains
3 CVEs0 on KEV0 new
JU9.8
Junie
JetBrains
3 CVEs0 on KEV0 new
SP9.8
Space
Jetbrains
3 CVEs0 on KEV0 new
CL9.8
Clion
Jetbrains
2 CVEs0 on KEV0 new
DO7.8
Dottrace
Jetbrains
2 CVEs0 on KEV0 new
MP7.5
Mps
Jetbrains
2 CVEs0 on KEV0 new
AQ7.5
Aqua
Jetbrains
1 CVEs0 on KEV0 new
DA7.5
Datagrip
Jetbrains
1 CVEs0 on KEV0 new
DA7.5
Dataspell
Jetbrains
1 CVEs0 on KEV0 new
DO7.8
Dotpeek
Jetbrains
1 CVEs0 on KEV0 new
EH7.8
Etw Host Service
Jetbrains
1 CVEs0 on KEV0 new
IS8.8
Ide Services
Jetbrains
1 CVEs0 on KEV0 new
ID7.5
Ideavim
Jetbrains
1 CVEs0 on KEV0 new
ID7.5
Idetalk
Jetbrains
1 CVEs0 on KEV0 new
JG8.8
Jetbrains Gateway
Jetbrains
1 CVEs0 on KEV0 new
RU7.8
Resharper Ultimate
Jetbrains
1 CVEs0 on KEV0 new
RU7.8
Runtime
Jetbrains
1 CVEs0 on KEV0 new
RU7.5
Rustrover
Jetbrains
1 CVEs0 on KEV0 new
SC7.5
Scala
Jetbrains
1 CVEs0 on KEV0 new
VI5.3
Vim
Jetbrains
1 CVEs0 on KEV0 new
YI9.8
Youtrack Integration
Jetbrains
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117530 New | JC Junie CLI JetBrains | 6.7 | Oct 27 | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands |
| CVE-2026-111096 | TE TeamCity JetBrains | 5.4 | Oct 15 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible |
| CVE-2026-111095 | TE TeamCity JetBrains | 5.4 | Oct 15 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible |
| CVE-2026-111094 | TE TeamCity JetBrains | 9.8 | Oct 15 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible |
| CVE-2026-111093 | DA Datalore JetBrains | 7.5 | Oct 15 | In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files |
| CVE-2026-111092 | YO YouTrack JetBrains | 6.5 | Oct 15 | In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands |
| CVE-2026-111091 | JC Junie CLI JetBrains | 7.8 | Oct 15 | In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration |
| CVE-2026-108474 | EX Exposed JetBrains | 9.8 | Oct 9 | In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions |
| CVE-2026-106219 | TE TeamCity JetBrains | 7.5 | Oct 6 | In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server |
| CVE-2026-106218 | TE TeamCity JetBrains | 10.0 | Oct 6 | In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible |
| CVE-2026-103497 | YO YouTrack JetBrains | 5.5 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration |
| CVE-2026-103496 | YO YouTrack JetBrains | 5.4 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications |
| CVE-2026-103495 | YO YouTrack JetBrains | 4.3 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs |
| CVE-2026-103494 | YO YouTrack JetBrains | 6.6 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes |
| CVE-2026-103493 | YO YouTrack JetBrains | 8.1 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible |
| CVE-2026-103492 | YO YouTrack JetBrains | 6.5 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments |
| CVE-2026-103491 | YO YouTrack JetBrains | 6.5 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues |
| CVE-2026-103490 | YO YouTrack JetBrains | 7.2 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links |
| CVE-2026-103489 | YO YouTrack JetBrains | 5.4 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible |
| CVE-2026-103488 | YO YouTrack JetBrains | 7.1 | Oct 1 | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues |
| CVE-2026-100280 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible |
| CVE-2026-100279 | YO YouTrack JetBrains | 6.5 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials |
| CVE-2026-100278 | YO YouTrack JetBrains | 4.9 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments |
| CVE-2026-100277 | YO YouTrack JetBrains | 9.8 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature |
| CVE-2026-100276 | YO YouTrack JetBrains | 7.5 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action |
| CVE-2026-100275 | YO YouTrack JetBrains | 4.8 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible |
| CVE-2026-100274 | YO YouTrack JetBrains | 6.5 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template |
| CVE-2026-100273 | YO YouTrack JetBrains | 9.8 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution |
| CVE-2026-100272 | YO YouTrack JetBrains | 4.9 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues |
| CVE-2026-100271 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |
| CVE-2026-100270 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations |
| CVE-2026-100269 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed |
| CVE-2026-100268 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates |
| CVE-2026-100267 | YO YouTrack JetBrains | 5.9 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters |
| CVE-2026-100266 | HU Hub JetBrains | 6.5 | Sep 30 | In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address |
| CVE-2026-100265 | RI Rider JetBrains | 6.5 | Sep 30 | In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation |
| CVE-2026-100264 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
| CVE-2026-100263 | YO YouTrack JetBrains | 6.1 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible |
| CVE-2026-100262 | YO YouTrack JetBrains | 7.1 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates |
| CVE-2026-100261 | YO YouTrack JetBrains | 5.4 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission |
| CVE-2026-100260 | YO YouTrack JetBrains | 5.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset |
| CVE-2026-100259 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access |
| CVE-2026-100258 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
| CVE-2026-100257 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export |
| CVE-2026-100256 | II IntelliJ IDEA JetBrains | 7.8 | Sep 30 | In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects |
| CVE-2026-100255 | TE TeamCity JetBrains | 9.8 | Sep 30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset |
| CVE-2026-100254 | TE TeamCity JetBrains | 8.8 | Sep 30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings |
| CVE-2026-100253 | TE TeamCity JetBrains | 8.8 | Sep 30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL |
| CVE-2026-86506 | GO GoLand JetBrains | 5.9 | Sep 7 | In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data |
| CVE-2026-86505 | II IntelliJ IDEA JetBrains | 3.3 | Sep 7 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace |
| CVE-2026-86504 | II IntelliJ IDEA JetBrains | 7.8 | Sep 7 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution |
| CVE-2026-86503 | II IntelliJ IDEA JetBrains | 3.3 | Sep 7 | In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching |
| CVE-2026-86502 | II IntelliJ IDEA JetBrains | 8.4 | Sep 7 | In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts |
| CVE-2026-86501 | II IntelliJ IDEA JetBrains | 2.8 | Sep 7 | In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log |
| CVE-2026-86500 | YO YouTrack JetBrains | 5.5 | Sep 7 | In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin |
| CVE-2026-86499 | YO YouTrack JetBrains | 4.3 | Sep 7 | In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission |
| CVE-2026-86498 | YO YouTrack JetBrains | 7.7 | Sep 7 | In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission |
| CVE-2026-86497 | YO YouTrack JetBrains | 6.8 | Sep 7 | In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials |
| CVE-2026-86496 | YO YouTrack JetBrains | 4.3 | Sep 7 | In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses |
| CVE-2026-86495 | YO YouTrack JetBrains | 6.5 | Sep 7 | In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects |