jetbrains has 103 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 93 in the last 90 days against 1 in the 90 before. The busiest recent month was September 2026 with 57. The median CVSS is 6.5 (medium), with 6 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-862 (17) and CWE-863 (13). Most affected products: YouTrack (63), teamcity (13), intellij_idea (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —(1)
- Last 90 days
- 93 prev 1
Weakness classes
Products
- YouTrack 63
- teamcity 13
- intellij_idea 8
- IntelliJ IDEA 5
- Junie CLI 2
- hub 2
Worst active — by depth score
CVE-2026-63077Critical· 9.8In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol100CVE-2026-86478Critical· 9.8In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address66CVE-2024-37051Critical· 9.3GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.…64CVE-2026-75045Critical· 9.1In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature62CVE-2026-108474Critical· 9.8In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions54
JetBrains vulnerabilities
CVEs affecting JetBrains, newest first. Open any entry for full detail, references, and exploit status.
103 CVEsRSS
CVE-2026-75060High· 8.4In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
CVE-2026-75056High· 7.8In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
CVE-2026-75053Medium· 5.4In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
CVE-2026-63077Critical· 9.8CISA KEVPoCIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2025-67742Low· 3.8In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
CVE-2025-67741Medium· 4.6In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
CVE-2025-67740Low· 2.7In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
CVE-2025-67739Low· 3.1In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
CVE-2025-64457Medium· 4.2In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
CVE-2025-58335Medium· 5.5In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function
CVE-2025-58334High· 8.1In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves
In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves
CVE-2024-37051Critical· 9.3PoCGitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.…
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.…
CVE-2022-37009Low· 3.9In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible