jetbrains security advisories
38 threat alerts tracking vulnerabilities and security advisories that affect jetbrains products.
Vulnios monitors jetbrains CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent jetbrains security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-37051 — jetbrains — aqua, clion
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion
criticalCVE-2024-37051Critical Vulnerability: CVE-2026-75045 — jetbrains — youtrack
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
criticalCVE-2026-75045Critical Vulnerability: CVE-2026-62422 — jetbrains — youtrack
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access w
criticalCVE-2026-62422Critical Vulnerability: CVE-2026-64812 — jetbrains — intellij_idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
criticalCVE-2026-64812Critical Vulnerability: CVE-2026-64813 — jetbrains — intellij_idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
criticalCVE-2026-64813Critical Vulnerability: CVE-2026-59792 — jetbrains — intellij_idea
In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
criticalCVE-2026-59792Critical Vulnerability: CVE-2026-50242 — jetbrains — hub
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was po
criticalCVE-2026-50242Critical Vulnerability: CVE-2026-56141 — jetbrains — hub
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible
criticalCVE-2026-56141Critical Vulnerability: CVE-2026-56142 — jetbrains — hub
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
criticalCVE-2026-56142Critical Vulnerability: CVE-2021-43202 — jetbrains — teamcity
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
criticalCVE-2021-43202Critical Vulnerability: CVE-2021-43200 — jetbrains — teamcity
In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.
criticalCVE-2021-43200Critical Vulnerability: CVE-2021-43185 — jetbrains — youtrack
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
criticalCVE-2021-43185Critical Vulnerability: CVE-2021-43193 — jetbrains — teamcity
In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.
criticalCVE-2021-43193Critical Vulnerability: CVE-2021-43183 — jetbrains — hub
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.
criticalCVE-2021-43183Critical Vulnerability: CVE-2021-37544 — jetbrains — teamcity
In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.
criticalCVE-2021-37544Critical Vulnerability: CVE-2021-36209 — jetbrains — hub
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
criticalCVE-2021-36209Critical Vulnerability: CVE-2021-37549 — jetbrains — youtrack
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
criticalCVE-2021-37549Critical Vulnerability: CVE-2021-31897 — jetbrains — webstorm
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.
criticalCVE-2021-31897Critical Vulnerability: CVE-2021-31915 — jetbrains — teamcity
In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.
criticalCVE-2021-31915Critical Vulnerability: CVE-2021-31909 — jetbrains — teamcity
In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.
criticalCVE-2021-31909Critical Vulnerability: CVE-2021-31914 — jetbrains, microsoft — teamcity, windows
In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.
criticalCVE-2021-31914Critical Vulnerability: CVE-2021-25770 — jetbrains — youtrack
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
criticalCVE-2021-25770Critical Vulnerability: CVE-2020-25207 — jetbrains — toolbox
JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.
criticalCVE-2020-25207Critical Vulnerability: CVE-2020-11796 — jetbrains — space
In JetBrains Space through 2020-04-22, the password authentication implementation was insecure.
criticalCVE-2020-11796Critical Vulnerability: CVE-2020-11690 — jetbrains — intellij_idea
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.
criticalCVE-2020-11690Critical Vulnerability: CVE-2019-18364 — jetbrains — teamcity
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
criticalCVE-2019-18364Critical Vulnerability: CVE-2019-12736 — jetbrains — ktor
JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection.
criticalCVE-2019-12736Critical Vulnerability: CVE-2019-12157 — jetbrains — teamcity, upsource
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
criticalCVE-2019-12157Critical Vulnerability: CVE-2019-15039 — jetbrains — teamcity
An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.
criticalCVE-2019-15039Critical Vulnerability: CVE-2019-9873 — jetbrains — intellij_idea
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. T
criticalCVE-2019-9873Critical Vulnerability: CVE-2019-10104 — jetbrains — intellij_idea
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute cod
criticalCVE-2019-10104Critical Vulnerability: CVE-2019-9823 — jetbrains — intellij_idea
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration file
criticalCVE-2019-9823Critical Vulnerability: CVE-2019-10100 — jetbrains — youtrack_integration
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a c
criticalCVE-2019-10100Critical Vulnerability: CVE-2019-12850 — jetbrains — youtrack
A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
criticalCVE-2019-12850Critical Vulnerability: CVE-2019-12866 — jetbrains — youtrack
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
criticalCVE-2019-12866Critical Vulnerability: CVE-2019-9186 — jetbrains — intellij_idea
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server l
criticalCVE-2019-9186Critical Vulnerability: CVE-2019-12867 — jetbrains — youtrack
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
criticalCVE-2019-12867Critical Vulnerability: CVE-2019-12852 — jetbrains — youtrack
An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
criticalCVE-2019-12852
Track jetbrains exposure across your environment
Vulnios automatically cross-references your asset inventory against new jetbrains CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan