JetBrains Vulnerabilities and Affected Products

Products

TeamCity183 vulnerabilities
YouTrack62 vulnerabilities
IntelliJ IDEA49 vulnerabilities
Hub16 vulnerabilities
Ktor10 vulnerabilities
GoLand6 vulnerabilities
Rider6 vulnerabilities
Toolbox App6 vulnerabilities
WebStorm6 vulnerabilities
PyCharm5 vulnerabilities
PhpStorm4 vulnerabilities
Junie3 vulnerabilities
ReSharper2 vulnerabilities
RubyMine2 vulnerabilities
Aqua1 vulnerability
CLion1 vulnerability
DataGrip1 vulnerability
Datalore1 vulnerability
DataSpell1 vulnerability
dotTrace1 vulnerability
ETW Host Service1 vulnerability
IDE Services1 vulnerability
intellij_idea1 vulnerability
JetBrains Gateway1 vulnerability
Kotlin1 vulnerability

JetBrains vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-63077CRITICAL	JetBrains TeamCity Deserialization of Untrusted Data Vulnerability In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol CWE-502Jul 27, 20261 related artifact	CVSS9.8v3.1	EPSS10.7%	PoCs4	SignalsListed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2026-65907CRITICAL	Generated title:JetBrains TeamCity Git VCS Root Code Execution In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible CWE-94Jul 23, 2026	CVSS9.1v3.1	EPSS0.421%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-65908HIGH	Generated title:JetBrains PyCharm Arbitrary Code Execution via Malicious Python Executable on Untrusted Project Open In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open CWE-829Jul 23, 2026	CVSS8.6v3.1	EPSS0.126%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-65906HIGH	Generated title:JetBrains TeamCity Kotlin DSL Sandbox Escape Code Execution In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible CWE-94Jul 23, 2026	CVSS8.8v3.1	EPSS0.417%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64815HIGH	Generated title:JetBrains IntelliJ IDEA UI Designer Form File Code Injection In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files CWE-94Jul 23, 2026	CVSS8.1v3.1	EPSS0.33%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64814HIGH	Generated title:JetBrains IntelliJ IDEA Remote Development Unauthorized File Access In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session CWE-862Jul 23, 2026	CVSS8.6v3.1	EPSS0.315%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64813CRITICAL	Generated title:JetBrains IntelliJ IDEA Remote Development Session Unauthorized Settings Modification In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session CWE-602Jul 23, 2026	CVSS10.0v3.1	EPSS0.393%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64812CRITICAL	Generated title:JetBrains IntelliJ IDEA Remote Development Session Unauthorized Input Injection In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session CWE-306Jul 23, 2026	CVSS10.0v3.1	EPSS0.363%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64811HIGH	Generated title:JetBrains IntelliJ IDEA Development Container Configuration Arbitrary Code Execution In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration CWE-829Jul 23, 2026	CVSS7.8v3.1	EPSS0.126%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64810MEDIUM	Generated title:JetBrains IntelliJ IDEA HTML Injection in IDE Notification In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking CWE-79Jul 23, 2026	CVSS4.3v3.1	EPSS0.149%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64809HIGH	Generated title:JetBrains PhpStorm Arbitrary Code Execution via Configured Interpreter Before Project Trust In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter CWE-829Jul 23, 2026	CVSS8.4v3.1	EPSS0.14%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64808HIGH	Generated title:JetBrains PhpStorm Arbitrary Code Execution via Project Tooling Before Project Trust In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling CWE-829Jul 23, 2026	CVSS8.4v3.1	EPSS0.14%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64807HIGH	Generated title:JetBrains WebStorm Arbitrary Code Execution via Project-Supplied Linter Configuration In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration CWE-829Jul 23, 2026	CVSS7.8v3.1	EPSS0.126%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64806HIGH	Generated title:JetBrains WebStorm Arbitrary Code Execution via Untrusted Node.js Interpreter In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter CWE-829Jul 23, 2026	CVSS8.4v3.1	EPSS0.14%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64805HIGH	Generated title:JetBrains WebStorm Arbitrary Code Execution via Untrusted Project-Local Package Manager Tooling In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling CWE-829Jul 23, 2026	CVSS8.4v3.1	EPSS0.14%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64804HIGH	Generated title:JetBrains WebStorm Arbitrary Code Execution via Project-Local Linter Tooling In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling CWE-829Jul 23, 2026	CVSS8.4v3.1	EPSS0.14%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64803HIGH	Generated title:JetBrains GoLand Code Injection via Configured Go SDK In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK CWE-94Jul 23, 2026	CVSS7.8v3.1	EPSS0.143%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64802HIGH	Generated title:JetBrains GoLand Go Modules Integration Code Injection In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration CWE-94Jul 23, 2026	CVSS7.8v3.1	EPSS0.143%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-64800LOW	Generated title:JetBrains GoLand Sensitive Configuration Information Disclosure in Log Files In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default CWE-532Jul 23, 2026	CVSS3.5v3.1	EPSS0.491%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-62422CRITICAL	Generated title:JetBrains YouTrack Authentication Bypass via Direct Database Access In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible CWE-306Jul 14, 2026	CVSS10.0v3.1	EPSS0.329%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-61492LOW	Generated title:JetBrains YouTrack Stored Cross-Site Scripting via Article Titles in Digest Emails In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible CWE-79Jul 10, 2026	CVSS3.5v3.1	EPSS0.391%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59796HIGH	Generated title:JetBrains TeamCity Missing Authorization on Pipeline Modification In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks CWE-862Jul 10, 2026	CVSS8.1v3.1	EPSS0.273%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59795HIGH	Generated title:JetBrains TeamCity Stored Cross-Site Scripting via Unauthenticated Agent Registration In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible CWE-79Jul 10, 2026	CVSS8.1v3.1	EPSS0.264%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59794HIGH	Generated title:JetBrains TeamCity Cloud Profile Page Stored Cross-Site Scripting In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data CWE-79Jul 10, 2026	CVSS7.3v3.1	EPSS0.208%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59793HIGH	Generated title:JetBrains TeamCity Perforce VCS Integration Arbitrary File Access In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration CWE-73Jul 10, 2026	CVSS8.8v3.1	EPSS0.377%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX