CVE Tools
Track your stack

Jetbrains

660 CVEs tracked since 2015. Since Jan 2015, 2 of them reached CISA KEV.

Jetbrains CVEs per month

Jan 2015 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Jetbrains CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2015-0120
2015-021 or fewer
2015-030
2015-040
2015-050
2015-061 or fewer
2015-070
2015-080
2015-090
2015-100
2015-110
2015-120
2016-010
2016-020
2016-030
2016-040
2016-050
2016-060
2016-070
2016-08no snapshot
2016-090
2016-100
2016-11no snapshot
2016-120
2017-01no snapshot
2017-021 or fewer
2017-031 or fewer
2017-04no snapshot
2017-051 or fewer
2017-06no snapshot
2017-071 or fewer
2017-082 or fewer
2017-091 or fewer
2017-101 or fewer
2017-11no snapshot
2017-121 or fewer
2018-012 or fewer
2018-021 or fewer
2018-032 or fewer
2018-04no snapshot
2018-05no snapshot
2018-062 or fewer
2018-072 or fewer
2018-0820
2018-092 or fewer
2018-102 or fewer
2018-11no snapshot
2018-122 or fewer
2019-01no snapshot
2019-021 or fewer
2019-03no snapshot
2019-04no snapshot
2019-051 or fewer
2019-06no snapshot
2019-07210
2019-082 or fewer
2019-092 or fewer
2019-10340
2019-112 or fewer
2019-1220
2020-01120
2020-022 or fewer
2020-032 or fewer
2020-04no snapshot
2020-05no snapshot
2020-062 or fewer
2020-07no snapshot
2020-08160
2020-091 or fewer
2020-101 or fewer
2020-11140
2020-122 or fewer
2021-012 or fewer
2021-02260
2021-03no snapshot
2021-042 or fewer
2021-05280
2021-062 or fewer
2021-072 or fewer
2021-08160
2021-092 or fewer
2021-102 or fewer
2021-11240
2021-122 or fewer
2022-012 or fewer
2022-02290
2022-033 or fewer
2022-04160
2022-0540
2022-063 or fewer
2022-0750
2022-0840
2022-093 or fewer
2022-102 or fewer
2022-1180
2022-12100
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-0440
2023-05120
2023-0640
2023-07130
2023-0840
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-0290
2024-03152
2024-044 or fewer
2024-05220
2024-0650
2024-0780
2024-0850
2024-0940
2024-10180
2024-114 or fewer
2024-12150
2025-0170
2025-023 or fewer
2025-0360
2025-04100
2025-0560
2025-0650
2025-07130
2025-08100
2025-0940
2025-104 or fewer
2025-11120
2025-12120
2026-015 or fewer
2026-0270
2026-037 or fewer
2026-046 or fewer
2026-05220
2026-06110
2026-07270
2026-08180
2026-09570
2026-10220
2026-110

Products

The products that kept showing up in Jetbrains's monthly top three, with their CVEs summed over those months.

  1. Teamcity26641 months
  2. Youtrack17128 months
  3. Intellij Idea6416 months
  4. Hub2310 months
  5. Ktor117 months
  6. Toolbox73 months
  7. Youtrack Mobile61 month
  8. Pycharm53 months
  9. Scala Plugin For Intellij Idea42 months
  10. Toolbox App41 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Jetbrains.

  1. CVE-2026-123858In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects4.4
  2. CVE-2026-123857In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection4.3
  3. CVE-2026-123856In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server6.5
  4. CVE-2026-123855In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs7.5
  5. CVE-2026-123854In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module5.5
  6. CVE-2026-123853In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process7.8
  7. CVE-2026-123851In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters5.4
  8. CVE-2026-123852In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates7.4
  9. CVE-2026-123850In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives3.5
  10. CVE-2026-123849In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers7.0
  11. CVE-2026-123848In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates7.4
  12. CVE-2026-123847In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion5.3
  13. CVE-2026-123845In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects3.3
  14. CVE-2026-123846In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation4.3
  15. CVE-2026-123843In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration3.3

The record

Peak rank
#19 in Oct 2019
Busiest month shown
Sep 2026, 57 CVEs
Months with a KEV entry
1 since Jan 2015
Monthly snapshots
50 since 2015
Jetbrains's full record, month by month