JetBrains

Records788All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical84CVSS 9.0–10.0

CVSS high249CVSS 7.0–8.9

Exploited now

JetBrains records in CISA KEV

TI-2026-45031 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2026-08-05 TI-2024-18054 JetBrains TeamCity Relative Path Traversal Vulnerability CRITICAL 89KEV 2026-04-20 TI-2024-18053 JetBrains TeamCity Authentication Bypass Vulnerability CRITICAL 100KEV 2024-03-07 TI-2023-22884 JetBrains TeamCity Authentication Bypass Vulnerability CRITICAL 100KEV 2023-10-04

Components

Products in the NVD configurations · select one to filter the records

Teamcity 283 records CRITICAL Youtrack 157 records MEDIUM Intellij Idea 77 records HIGH Hub 37 records MEDIUM Ktor 21 records MEDIUM Pycharm 12 records HIGH Toolbox 11 records MEDIUM Rider 9 records HIGH

Records

37 records in Hub · all components

TI-2026-36991 CVE-2026-50242 · GHSA-xqpc-xqhc-3crx

Missing authentication in JetBrains Hub

MEDIUM 50

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00611 Published 2026-06-19 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 CWE-306

TI-2026-40517 CVE-2026-56141 · GHSA-cq2r-w6jr-x35w

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120…

MEDIUM 49

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00522 Published 2026-06-19 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 CWE-338

TI-2026-20894 CVE-2026-25848 · GHSA-m7gw-jxv4-qv8m

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

MEDIUM 49

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00465 Published 2026-02-09 Fixed in 2025.3.119807 CWE-306

TI-2022-08968 CVE-2022-25262 · GHSA-3fcg-56fr-gpww

In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

MEDIUM 45

In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01452 Published 2022-02-25 No fix listed CWE-345

TI-2026-40518 CVE-2026-56142 · GHSA-v6fr-2xp3-xpr7

Mass assignment in JetBrains Hub

MEDIUM 44

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00623 Published 2026-06-19 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 CWE-915

TI-2022-08966 CVE-2022-25260 · GHSA-m37j-2vr4-qq8w

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

MEDIUM 44

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02391 Published 2022-02-25 No fix listed CWE-918

TI-2021-19195 CVE-2021-43183 · GHSA-2fc3-gg5g-pf65

In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.

MEDIUM 44

In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01181 Published 2021-11-09 No fix listed

TI-2021-14624 CVE-2021-36209 · GHSA-rh6h-f4gj-hpgv

In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.

MEDIUM 44

In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0103 Published 2021-08-06 No fix listed CWE-640

TI-2022-24057 CVE-2022-48477 · GHSA-747c-jg37-7m9c

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

MEDIUM 43

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00482 Published 2023-04-24 Fixed in 2023.1.15725 CWE-918

TI-2025-18189 CVE-2025-24456 · GHSA-m643-p29m-frx3

In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping

MEDIUM 40

In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00295 Published 2025-01-21 Fixed in 2024.3.55417 CWE-288

TI-2025-40038 CVE-2025-64683 · GHSA-f747-w67p-qmf9

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

LOW 38

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00217 Published 2025-11-10 Fixed in 2025.3.104432 CWE-362

TI-2022-08205 CVE-2022-24327 · GHSA-cm93-88xh-rg58

In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.

LOW 35

In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00913 Published 2022-02-25 No fix listed CWE-732

TI-2021-19194 CVE-2021-43182 · GHSA-3q6c-xv98-jf35

In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.

LOW 35

In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00961 Published 2021-11-09 No fix listed

TI-2021-19192 CVE-2021-43180 · GHSA-pmv7-fx9m-r47p

In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.

LOW 35

In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01003 Published 2021-11-09 No fix listed

TI-2022-22429 CVE-2022-45471 · GHSA-hq4m-5hfj-8xjc

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

LOW 34

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00563 Published 2022-11-18 Fixed in 2022.3.15181 CWE-770

TI-2021-11889 CVE-2021-31901 · GHSA-f33w-qrjh-rwcp

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.

LOW 34

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00864 Published 2021-05-11 No fix listed

TI-2020-09383 CVE-2020-11691 · GHSA-phpw-g8jw-q5f7

In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.

LOW 34

In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00872 Published 2020-04-22 No fix listed

TI-2019-09626 CVE-2019-12847 · GHSA-3h7w-w4qf-f3pr

In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings…

LOW 34

In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01094 Published 2019-07-03 No fix listed CWE-522

TI-2026-64607 CVE-2026-100266 · GHSA-f59m-626g-488f

Missing authorization in JetBrains Hub

LOW 33

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00228 Published 2026-09-30 Fixed in 2026.2.52366 CWE-862

TI-2026-24759 CVE-2026-32229 · GHSA-rjrm-hghf-rqww

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

LOW 31

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00198 Published 2026-03-11 Fixed in 2025.3.128064 CWE-290

TI-2022-08206 CVE-2022-24328 · GHSA-hh4r-8h4c-83j4

In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.

LOW 30

In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00819 Published 2022-02-25 No fix listed

TI-2021-15430 CVE-2021-37540 · GHSA-9rvc-xv25-jjh5

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.

LOW 30

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00665 Published 2021-08-06 No fix listed

TI-2021-07843 CVE-2021-25759 · GHSA-h3vx-vrfm-46v8

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.

LOW 30

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0074 Published 2021-02-03 No fix listed

TI-2022-12171 CVE-2022-29811 · GHSA-g5m9-8h5w-cxvx

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

LOW 28

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00485 Published 2022-04-28 Fixed in 2022.1.14638 CWE-79

TI-2022-08965 CVE-2022-25259 · GHSA-7c6v-jqv8-rjmr

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

LOW 28

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00568 Published 2022-02-25 No fix listed CWE-79

Open these records in search →