JetBrains vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 202246
3. 202354
4. 2024103
5. 202583
6. 2026169

Known exploitedNewest addition to KEV first

• CVE-2026-63077

  In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

  JetBrains · TeamCity

  ExploitedCritical9.8
• CVE-2024-27199

  In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

  JetBrains · TeamCity

  ExploitedHigh7.3
• CVE-2024-27198

  In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

  JetBrains · TeamCity

  ExploitedCritical9.8
• CVE-2023-42793

  In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

  JetBrains · TeamCity

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-118697

  In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion…

  JetBrains · Toolbox App

  Critical9.0
• CVE-2026-118696

  In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4,…

  JetBrains · IntelliJ IDEA

  High8.0
• CVE-2026-117530

  In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

  JetBrains · Junie CLI

  Medium6.7
• CVE-2026-111096

  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible

  JetBrains · TeamCity

  Medium6.7
• CVE-2026-111095

  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible

  JetBrains · TeamCity

  High8.0
• CVE-2026-111094

  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

  JetBrains · TeamCity

  High8.1
• CVE-2026-111093

  In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

  JetBrains · Datalore

  High7.5
• CVE-2026-111092

  In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

  JetBrains · YouTrack

  Medium6.5
• CVE-2026-111091

  In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

  JetBrains · Junie CLI

  High7.8
• CVE-2026-108474

  In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

  JetBrains · Exposed

  Critical9.8