CVE-2026-123853High 7.8In JetBrains IntelliJ IDEA before 2026.3,
2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process–
CVE-2026-123849High 7.0In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers–
CVE-2026-123848High 7.4In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates–
CVE-2026-123847Medium 5.3In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion–
CVE-2026-123841High 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive–
CVE-2026-123838High 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file–
CVE-2026-123837High 7.8In JetBrains IntelliJ IDEA before 2026.3,
2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL–
CVE-2026-123311Medium 5.3In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible–
CVE-2026-123308Medium 6.3In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects–
CVE-2026-123307Medium 6.8In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible–
CVE-2026-123306High 7.4In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs–
CVE-2026-123305High 7.5In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host–
CVE-2026-123304High 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path–
CVE-2026-123302High 7.8In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4,
2026.1.5.1,
2025.3.6.2 code execution was possible in untrusted projects via script engine discovery–
CVE-2026-123293High 7.8In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting–
CVE-2026-123278Medium 6.7In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint–
CVE-2026-118697Critical 9.0In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 0.3%
CVE-2026-118696High 8.0In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.0.3%
CVE-2026-100256High 7.8In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects0.1%
CVE-2026-86505Low 3.3In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace0.2%
CVE-2026-86504High 7.8In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution0.2%
CVE-2026-86503Low 3.3In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching0.1%
CVE-2026-86502High 8.4In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts0.2%
CVE-2026-86501Low 2.8In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log0.4%
CVE-2026-75058Medium 5.5In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers0.2%
CVE-2026-75057Medium 6.2In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log0.2%
CVE-2026-75056High 7.8In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible0.2%
CVE-2026-75055Medium 5.5In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE0.2%
CVE-2026-75054Medium 6.3In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects0.2%
CVE-2026-75053Medium 5.4In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint0.2%
CVE-2026-75052Low 3.6In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects0.2%
CVE-2026-64815High 8.1In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files0.5%
CVE-2026-64814High 8.6In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session0.4%
CVE-2026-64813Critical 10.0In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session0.5%
CVE-2026-64812Critical 10.0In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session0.5%
CVE-2026-64811High 7.8In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration0.2%
CVE-2026-64810Medium 4.3In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking0.3%
CVE-2026-59792Critical 9.6In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible0.6%
CVE-2026-49383Low 3.3In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible0.1%
CVE-2026-49382Medium 4.5In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin0.1%
CVE-2026-49367High 8.0In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account0.3%
CVE-2026-49366High 7.8In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion0.5%
CVE-2026-41882High 7.4In JetBrains IntelliJ IDEA before 2024.3.7.1,
2025.1.7.1,
2025.2.6.2,
2025.3.4.1,
2026.1.1 reading arbitrary local files was possible via built-in web server0.4%
CVE-2025-68269Medium 5.4In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH0.1%
CVE-2025-57730Medium 5.2In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature0.4%
CVE-2025-57729Medium 6.5In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start0.1%
CVE-2025-57728Medium 6.5In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files0.2%
CVE-2025-57727Medium 4.7In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference0.2%
CVE-2025-32054Low 3.3In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file0.4%
CVE-2024-46970Low 3.3In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible0.4%