Jetbrains vulnerabilities
696 vulnerabilities
Known vulnerabilities in Jetbrains products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 42 products.
Products
42- Teamcity284 vulnerabilities
- Youtrack180 vulnerabilities
- Intellij Idea82 vulnerabilities
- Hub38 vulnerabilities
- Ktor22 vulnerabilities
- Pycharm12 vulnerabilities
- Toolbox11 vulnerabilities
- Rider10 vulnerabilities
- Goland9 vulnerabilities
- Webstorm9 vulnerabilities
- Kotlin7 vulnerabilities
- Phpstorm6 vulnerabilities
- Toolbox App6 vulnerabilities
- Youtrack Mobile6 vulnerabilities
- Upsource5 vulnerabilities
- Resharper4 vulnerabilities
- Rubymine4 vulnerabilities
- Code With Me3 vulnerabilities
- Junie3 vulnerabilities
- Space3 vulnerabilities
- Clion2 vulnerabilities
- Datalore2 vulnerabilities
- Dottrace2 vulnerabilities
- Mps2 vulnerabilities
- Aqua1 vulnerabilities
- Datagrip1 vulnerabilities
- Dataspell1 vulnerabilities
- Dotpeek1 vulnerabilities
- Etw Host Service1 vulnerabilities
- Exposed1 vulnerabilities
- Ide Services1 vulnerabilities
- Ideavim1 vulnerabilities
- Idetalk1 vulnerabilities
- Jetbrains Gateway1 vulnerabilities
- Junie CLI1 vulnerabilities
- Resharper, Rider And Dottrace1 vulnerabilities
- Resharper Ultimate1 vulnerabilities
- Runtime1 vulnerabilities
- Rustrover1 vulnerabilities
- Scala1 vulnerabilities
- Vim1 vulnerabilities
- Youtrack Integration1 vulnerabilities
CVE-2026-111096jetbrainsteamcity
EPSS score0.18%
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possibleCVE-2026-111095jetbrainsteamcityEPSS score0.17%
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possibleCVE-2026-111094jetbrainsteamcityEPSS score0.38%
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possibleCVE-2026-111093jetbrainsdataloreEPSS score0.37%
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary filesCVE-2026-111092jetbrainsyoutrackEPSS score0.27%
In JetBrains YouTrack before 2026.2.19575
2026.3.16075
2026.3.16397
2026.3.16402 mail rules allowed a project admin to execute cross-project issue commandsCVE-2026-111091jetbrainsjunie cliEPSS score0.14%
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configurationCVE-2018-14878jetbrainsdotpeek+1EPSS score1.56%
JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific file, because of Deserialization of Untrusted Data.CVE-2021-26309jetbrainsteamcityEPSS score0.23%
Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.CVE-2021-26310jetbrainsteamcityEPSS score1.55%
In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.CVE-2021-31906jetbrainsteamcityEPSS score0.57%
In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.CVE-2021-31913jetbrainsteamcityEPSS score0.71%
In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.CVE-2021-31900jetbrainscode_with_meEPSS score0.71%
In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.CVE-2021-31910jetbrainsteamcityEPSS score1.35%
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.CVE-2021-31908jetbrainsteamcityEPSS score0.46%
In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.CVE-2021-31905jetbrainsyoutrackEPSS score1.88%
In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.CVE-2021-31912jetbrainsteamcityEPSS score1.24%
In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.CVE-2021-31914jetbrainsteamcityEPSS score2.25%
In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.CVE-2021-31903jetbrainsyoutrackEPSS score0.78%
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.CVE-2021-31904jetbrainsteamcityEPSS score0.75%
In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.CVE-2021-31907jetbrainsteamcityEPSS score0.88%
In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.