JetBrains
Vulnerability activity for JetBrains: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 16
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 24
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 2
- With exploit code
- 2
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.8CriticalAug 5, 2026JetBrains TeamCity DeserializationCVE-2026-63077JetBrains TeamCity server is affected. An attacker gains remote code execution on the TeamCity server. Update to the latest version of JetBrains TeamCity, and ensure deserialization is only performed on trusted data.Added to KEV Aug 5, 2026Exploited94% likelyExploit codeMetasploit · NucleiDetection
- 7.3HighApr 20, 2026JetBrains TeamCity Path traversal / file handlingCVE-2024-27199Affected: JetBrains TeamCity, a continuous integration and continuous deployment server. Attacker gains: Ability to access and read arbitrary files on the server. Recommended action: Update to the latest version of JetBrains TeamCity to patch the vulnerability.Added to KEV Apr 20, 2026Exploited100% likelyExploit codeNucleiDetection
- 9.8CriticalMar 4, 2024JetBrains TeamCity Auth bypass / access controlCVE-2024-271981. JetBrains TeamCity server is affected. 2. An attacker gains unauthenticated access to TeamCity server and can execute arbitrary code. 3. Update TeamCity to version 2024.1.2 or later.Added to KEV Mar 7, 2024 · 2 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalSep 19, 2023JetBrains TeamCity Auth bypass / access controlCVE-2023-42793Affected: JetBrains TeamCity server, allowing unauthenticated access to sensitive features. Attacker gains: Unauthorized access to project configurations, build histories, and potentially sensitive data. Recommended action: Update TeamCity server to the latest version (2022.04 or later) and ensure all users are re-authenticated after the update.Added to KEV Oct 4, 2023 · 14 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Recent
- 6.7MediumOct 27, 2026JetBrains Junie CLICVE-2026-117530In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
- –UnscoredOct 15, 2026JetBrainsADV-cccs-386812e41921Serial number: AV26-1050 Date: October 15, 2026 As of October 15, 2026, JetBrains is affected by vulnerabilities in the following products: Datalore Prior to 2026.2.1 Junie CLI Prior to 26.8.3 TeamCity Prior to 2026.2 Prior to 2026.1.4 Prior to 2025.11.8 YouTrack Prior to 2026.2.19575 Piror to 2026.3.16075 Prior to 2026.3.16397 Prior to 2026.3.16402 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Fixe
- 8.4HighAug 17, 2026Jetbrains pycharm Auth bypass / access controlCVE-2026-75060In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
- 4.4MediumAug 17, 2026Jetbrains pycharm XSSCVE-2026-75059In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
- 5.5MediumAug 17, 2026Jetbrains intellij ideaCVE-2026-75058In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
- 6.2MediumAug 17, 2026Jetbrains intellij idea Information disclosureCVE-2026-75057In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
- 7.8HighAug 17, 2026Jetbrains intellij idea Code / command injectionCVE-2026-75056In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
- 5.5MediumAug 17, 2026Jetbrains intellij ideaCVE-2026-75055In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
- 6.3MediumAug 17, 2026Jetbrains intellij idea SSRFCVE-2026-75054In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
- 5.4MediumAug 17, 2026Jetbrains intellij idea SSRFCVE-2026-75053In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
- 3.6LowAug 17, 2026Jetbrains intellij idea Code / command injectionCVE-2026-75052In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
- 8.1HighAug 17, 2026Jetbrains youtrack Auth bypass / access controlCVE-2026-75051In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
- 7.1HighAug 17, 2026Jetbrains youtrack Denial of serviceCVE-2026-75050In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters1.1% likely
- 6.5MediumAug 17, 2026Jetbrains youtrack Auth bypass / access controlCVE-2026-75049In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
- 8.2HighAug 17, 2026Jetbrains youtrack XSSCVE-2026-75048In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
- 9.8CriticalAug 5, 2026JetBrains TeamCity DeserializationCVE-2026-63077JetBrains TeamCity server is affected. An attacker gains remote code execution on the TeamCity server. Update to the latest version of JetBrains TeamCity, and ensure deserialization is only performed on trusted data.Exploited94% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalJul 14, 2026Jetbrains youtrack Auth bypass / access controlCVE-2026-62422In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
- 8.1HighJul 10, 2026Jetbrains teamcity Auth bypass / access controlCVE-2026-59796In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
- 8.1HighJul 10, 2026Jetbrains teamcity XSSCVE-2026-59795In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
- 7.3HighJul 10, 2026Jetbrains teamcity XSSCVE-2026-59794In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
- 8.8HighJul 10, 2026Jetbrains teamcity Path traversal / file handlingCVE-2026-59793In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
- 9.6CriticalJul 10, 2026Jetbrains intellij idea Path traversal / file handlingCVE-2026-59792In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
- 3.5LowJul 10, 2026Jetbrains youtrackCVE-2026-59791In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
- 7.3HighApr 20, 2026JetBrains TeamCity Path traversal / file handlingCVE-2024-27199Affected: JetBrains TeamCity, a continuous integration and continuous deployment server. Attacker gains: Ability to access and read arbitrary files on the server. Recommended action: Update to the latest version of JetBrains TeamCity to patch the vulnerability.Exploited100% likelyExploit codeNucleiDetection
- 9.8CriticalMar 4, 2024JetBrains TeamCity Auth bypass / access controlCVE-2024-271981. JetBrains TeamCity server is affected. 2. An attacker gains unauthenticated access to TeamCity server and can execute arbitrary code. 3. Update TeamCity to version 2024.1.2 or later.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalSep 19, 2023JetBrains TeamCity Auth bypass / access controlCVE-2023-42793Affected: JetBrains TeamCity server, allowing unauthenticated access to sensitive features. Attacker gains: Unauthorized access to project configurations, build histories, and potentially sensitive data. Recommended action: Update TeamCity server to the latest version (2022.04 or later) and ensure all users are re-authenticated after the update.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Top products
- intellij idea8 CVEs in the last year, 1 critical
- youtrack6 CVEs in the last year, 1 critical
- TeamCity6 CVEs in the last year, 1 critical, 2 exploited
- pycharm2 CVEs in the last year
- Junie CLI1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 15, 2026JetBrains security advisory (AV26-1050)ADV-cccs-386812e41921
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.