CVE Tools
Track your stack

Toolbox App

10 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Toolbox App, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Toolbox App CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Toolbox App CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-044
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-101
2026-113

Severity

How the 10 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical110%
  • High220%
  • Medium660%
  • Low110%

Latest CVEs

The 10 most recently published vulnerabilities affecting Toolbox App.

  1. CVE-2026-123856In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server6.5
  2. CVE-2026-123855In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs7.5
  3. CVE-2026-123320In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server3.1
  4. CVE-2026-118697In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip befo...9.0
  5. CVE-2025-43012In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible8.3
  6. CVE-2025-43014In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation6.1
  7. CVE-2025-43013In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible6.9
  8. CVE-2025-42921In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin4.2
  9. CVE-2024-24943In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image5.3
  10. CVE-2022-48481In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible5.2

Product grouping is registry-driven, with AI assist and human review. How it works