Vendor
788 published CVES affecting JetBrains, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first · page 1 of 32
In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects
In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server
In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection
In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs
In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process
In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers
In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives
In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL
In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup
In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account
In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.