JetBrains IntelliJ IDEA

• CVE-2026-118697 Critical 9.0 In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 0.3%
• CVE-2026-118696 High 8.0 In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026. 0.3%
• CVE-2026-100256 High 7.8 In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects 0.1%
• CVE-2026-86505 Low 3.3 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace 0.2%
• CVE-2026-86504 High 7.8 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution 0.2%
• CVE-2026-86503 Low 3.3 In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching 0.1%
• CVE-2026-86502 High 8.4 In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts 0.2%
• CVE-2026-86501 Low 2.8 In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log 0.4%
• CVE-2026-75058 Medium 5.5 In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers 0.2%
• CVE-2026-75057 Medium 6.2 In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log 0.2%
• CVE-2026-75056 High 7.8 In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible 0.2%
• CVE-2026-75055 Medium 5.5 In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE 0.2%
• CVE-2026-75054 Medium 6.3 In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects 0.2%
• CVE-2026-75053 Medium 5.4 In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint 0.2%
• CVE-2026-75052 Low 3.6 In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects 0.2%
• CVE-2026-64815 High 8.1 In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files 0.5%
• CVE-2026-64814 High 8.6 In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session 0.4%
• CVE-2026-64813 Critical 10.0 In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session 0.5%
• CVE-2026-64812 Critical 10.0 In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session 0.5%
• CVE-2026-64811 High 7.8 In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration 0.2%
• CVE-2026-64810 Medium 4.3 In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking 0.3%
• CVE-2026-59792 Critical 9.6 In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible 0.6%
• CVE-2026-49383 Low 3.3 In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible 0.1%
• CVE-2026-49382 Medium 4.5 In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin 0.1%
• CVE-2026-49367 High 8.0 In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account 0.3%
• CVE-2026-49366 High 7.8 In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion 0.5%
• CVE-2026-41882 High 7.4 In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server 0.4%
• CVE-2025-68269 Medium 5.4 In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH 0.1%
• CVE-2025-57730 Medium 5.2 In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature 0.4%
• CVE-2025-57729 Medium 6.5 In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start 0.1%
• CVE-2025-57728 Medium 6.5 In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files 0.2%
• CVE-2025-57727 Medium 4.7 In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference 0.2%
• CVE-2025-32054 Low 3.3 In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file 0.4%
• CVE-2024-46970 Low 3.3 In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible 0.4%
• CVE-2024-37051 Critical 9.3 GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 4.9%
• CVE-2024-24941 Medium 6.1 In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL 0.3%
• CVE-2024-24940 Low 2.8 In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives 0.3%
• CVE-2023-51655 Medium 6.3 In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration 0.3%
• CVE-2023-39261 Medium 5.2 In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions 0.3%
• CVE-2023-38069 Low 3.3 In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases 0.2%
• CVE-2022-48433 Medium 6.1 In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. 0.6%
• CVE-2022-48432 Medium 5.2 In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. 0.2%
• CVE-2022-48431 Medium 4.5 In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. 0.1%
• CVE-2022-48430 Medium 5.5 In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. 0.3%
• CVE-2022-47896 Medium 5.0 In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. 0.3%
• CVE-2022-47895 Medium 4.7 In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. 0.2%
• CVE-2022-46828 Medium 5.2 In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. 0.3%
• CVE-2022-46827 Low 3.9 In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. 0.2%
• CVE-2022-46826 Medium 6.2 In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. 0.2%
• CVE-2022-46825 Medium 4.0 In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. 0.1%