CVE Tools
Track your stack

Intellij Idea

114 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Intellij Idea, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Intellij Idea CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Intellij Idea CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-041
2025-050
2025-060
2025-070
2025-084
2025-090
2025-100
2025-110
2025-121
2026-010
2026-020
2026-030
2026-041
2026-054
2026-060
2026-077
2026-087
2026-096
2026-102
2026-1130

Severity

How the 114 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1110%
  • High3732%
  • Medium4439%
  • Low2219%

Latest CVEs

The 15 most recently published vulnerabilities affecting Intellij Idea.

  1. CVE-2026-123853In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process7.8
  2. CVE-2026-123849In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers7.0
  3. CVE-2026-123848In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates7.4
  4. CVE-2026-123847In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion5.3
  5. CVE-2026-123845In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects3.3
  6. CVE-2026-123846In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation4.3
  7. CVE-2026-123843In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration3.3
  8. CVE-2026-123844In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories5.3
  9. CVE-2026-123842In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives7.1
  10. CVE-2026-123841In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive7.8
  11. CVE-2026-123839In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model4.7
  12. CVE-2026-123840In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs4.7
  13. CVE-2026-123838In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file7.8
  14. CVE-2026-123837In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL7.8
  15. CVE-2026-123833In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects3.6

Product grouping is registry-driven, with AI assist and human review. How it works