JetBrains vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 202246
3. 202354
4. 2024103
5. 202583
6. 2026258

Known exploitedNewest addition to KEV first

• CVE-2026-63077

  In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

  JetBrains · TeamCity

  ExploitedCritical9.8
• CVE-2024-27199

  In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

  JetBrains · TeamCity

  ExploitedHigh7.3
• CVE-2024-27198

  In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

  JetBrains · TeamCity

  ExploitedCritical9.8
• CVE-2023-42793

  In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

  JetBrains · TeamCity

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-123858

  In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

  JetBrains · PhpStorm

  Medium4.4
• CVE-2026-123857

  In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection

  JetBrains · PhpStorm

  Medium4.3
• CVE-2026-123856

  In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server

  JetBrains · Toolbox App

  Medium6.5
• CVE-2026-123855

  In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

  JetBrains · Toolbox App

  High7.5
• CVE-2026-123854

  In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

  JetBrains · PyCharm

  Medium5.5
• CVE-2026-123853

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

  JetBrains · IntelliJ IDEA

  High7.8
• CVE-2026-123852

  In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

  JetBrains · Junie GitHub Action

  High7.4
• CVE-2026-123851

  In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

  JetBrains · Junie GitHub Action

  Medium5.4
• CVE-2026-123850

  In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

  JetBrains · YouTrack

  Low3.5
• CVE-2026-123849

  In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

  JetBrains · IntelliJ IDEA

  High7.0