JetBrains has 102 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 93 in the last 90 days against 1 in the 90 before. The busiest recent month was September 2026 with 57. The median CVSS is 6.5 (medium), with 5 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-862 (17) and CWE-863 (13). Most affected products: YouTrack (63), TeamCity (13), intellij_idea (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —(1)
- Last 90 days
- 93 prev 1
Weakness classes
Products
- YouTrack 63
- TeamCity 13
- intellij_idea 8
- IntelliJ IDEA 5
- Junie CLI 2
- hub 2
Worst active — by depth score
CVE-2026-63077Critical· 9.8In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol100CVE-2026-86478Critical· 9.8In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address66CVE-2026-75045Critical· 9.1In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature62CVE-2026-108474Critical· 9.8In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions54CVE-2026-86480Critical· 9.8In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges54
JetBrains vulnerabilities
CVEs affecting JetBrains, newest first. Open any entry for full detail, references, and exploit status.
102 CVEsRSS
CVE-2026-117530Medium· 6.7In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
CVE-2026-111091High· 7.8In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
CVE-2026-111094High· 8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVE-2026-111093High· 7.5In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
CVE-2026-111092Medium· 6.5In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
CVE-2026-111095High· 8.0In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
CVE-2026-111096Medium· 6.7In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
CVE-2026-108474Critical· 9.8In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
CVE-2026-106218High· 8.8In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
CVE-2026-106219Medium· 6.5In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
CVE-2026-103488High· 7.1In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
CVE-2026-103491Medium· 6.5In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
CVE-2026-103490High· 7.2In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
CVE-2026-103489Low· 2.0In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
CVE-2026-103493High· 8.1In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
CVE-2026-103492Medium· 6.5In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
CVE-2026-103496Medium· 5.4In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
CVE-2026-103494Medium· 6.6In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
CVE-2026-103495Medium· 4.3In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
CVE-2026-103497Medium· 5.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
CVE-2026-100279Medium· 6.5In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
CVE-2026-100277High· 8.9In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
CVE-2026-100276Medium· 5.9In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
CVE-2026-100274Medium· 6.5In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
CVE-2026-100280Low· 3.1In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
CVE-2026-100278Medium· 4.9In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
CVE-2026-100275Medium· 6.9In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
CVE-2026-100266High· 7.7In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
CVE-2026-100265Medium· 4.8In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
CVE-2026-100273High· 8.2In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution