Jetbrains vulnerabilities

Products

• Teamcity 284
• Youtrack 196
• Hub 132
• Intellij Idea 94
• Intellij Idea 77
• Ktor 25
• Datalore 19
• Pycharm 15
• Webstorm 13
• Rider 12
• Goland 11
• Toolbox 11
• Phpstorm 10
• Toolbox App 10
• Clion 8
• Kotlin 7
• Rubymine 6
• Youtrack Mobile 6
• Upsource 5
• Junie Cli 4
• Resharper 4
• Aqua 3
• Code With Me 3
• Datagrip 3
• Junie 3
• Runtime 3
• Rustrover 3
• Space 3
• Dataspell 2
• Dottrace 2
• Junie Github Action 2
• Mps 2

Newest

• jetbrains phpstorm In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment... CVE-2026-123858 4.4 MediumNovember 6, 2026
• jetbrains phpstorm In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset... CVE-2026-123857 4.3 MediumNovember 6, 2026
• jetbrains toolbox app In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a... CVE-2026-123856 6.5 MediumNovember 6, 2026
• jetbrains toolbox app In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration... CVE-2026-123855 7.5 HighNovember 6, 2026
• jetbrains pycharm In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter... CVE-2026-123854 5.5 MediumNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via... CVE-2026-123853 7.8 HighNovember 6, 2026
• jetbrains junie github action In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was... CVE-2026-123852 7.4 HighNovember 6, 2026
• jetbrains junie github action In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via... CVE-2026-123851 5.4 MediumNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via... CVE-2026-123850 3.5 LowNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via... CVE-2026-123849 7.0 HighNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS... CVE-2026-123848 7.4 HighNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in... CVE-2026-123847 5.3 MediumNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON... CVE-2026-123846 4.3 MediumNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references... CVE-2026-123845 3.3 LowNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories CVE-2026-123844 5.3 MediumNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent... CVE-2026-123843 3.3 LowNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when... CVE-2026-123842 7.1 HighNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported... CVE-2026-123841 7.8 HighNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor... CVE-2026-123840 4.7 MediumNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible... CVE-2026-123839 4.7 MediumNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer... CVE-2026-123838 7.8 HighNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted... CVE-2026-123837 7.8 HighNovember 6, 2026
• jetbrains datalore In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private... CVE-2026-123836 8.8 HighNovember 6, 2026
• jetbrains datalore In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via... CVE-2026-123835 5.9 MediumNovember 6, 2026
• jetbrains datalore In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using... CVE-2026-123834 7.5 HighNovember 6, 2026
• jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted... CVE-2026-123833 3.6 LowNovember 6, 2026
• jetbrains clion In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation... CVE-2026-123832 9.6 CriticalNovember 6, 2026
• jetbrains clion In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson... CVE-2026-123831 9.6 CriticalNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue... CVE-2026-123337 3.1 LowNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI... CVE-2026-123336 3.1 LowNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization ... CVE-2026-123335 3.5 LowNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS... CVE-2026-123334 3.8 LowNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible... CVE-2026-123333 3.8 LowNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage... CVE-2026-123332 4.7 MediumNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted... CVE-2026-123331 5.4 MediumNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only... CVE-2026-123330 5.4 MediumNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed... CVE-2026-123329 5.4 MediumNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via... CVE-2026-123328 6.4 MediumNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint... CVE-2026-123327 7.5 HighNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed... CVE-2026-123326 7.1 HighNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted... CVE-2026-123325 7.1 HighNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message... CVE-2026-123324 7.7 HighNovember 6, 2026
• jetbrains youtrack In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation... CVE-2026-123323 8.4 HighNovember 6, 2026
• jetbrains webstorm In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects... CVE-2026-123322 6.3 MediumNovember 6, 2026
• jetbrains webstorm In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was... CVE-2026-123321 7.8 HighNovember 6, 2026
• jetbrains toolbox app In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting... CVE-2026-123320 3.1 LowNovember 6, 2026
• jetbrains ktor In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage... CVE-2026-123319 3.7 LowNovember 6, 2026
• jetbrains ktor In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine CVE-2026-123318 4.8 MediumNovember 6, 2026
• jetbrains ktor In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies CVE-2026-123317 8.1 HighNovember 6, 2026
• jetbrains junie cli In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session... CVE-2026-123316 5.5 MediumNovember 6, 2026
• Show olderLoading…