Vulnerabilities

Filters

Reset all

2 selected

77 records

Sort

Vendor: JetBrains Component: Intellij Idea Clear all filters

TI-2026-64597 CVE-2026-100256 · GHSA-x2cm-2gq8-g82v

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints…

LOW 35

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00133 Published 2026-09-30 Fixed in 2026.2.3 CWE-829

TI-2026-52744 CVE-2026-75058 · GHSA-4qhh-vhvg-gc9c

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

LOW 24

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00153 Published 2026-08-17 Fixed in 2026.2.1 CWE-611

TI-2026-52743 CVE-2026-75057 · GHSA-4gfp-9xp3-f73r

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

LOW 27

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00169 Published 2026-08-17 Fixed in 2026.1.5 CWE-532

TI-2026-52742 CVE-2026-75056 · GHSA-44p4-x76v-6w5f

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

LOW 35

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00194 Published 2026-08-17 Fixed in 2026.2.1 CWE-78

TI-2026-52741 CVE-2026-75055 · GHSA-pv7f-2fc9-p5x3

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

LOW 24

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00153 Published 2026-08-17 Fixed in 2026.2.1 CWE-611

TI-2026-52740 CVE-2026-75054 · GHSA-mw34-c6m6-g442

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

LOW 27

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

CVSS 3.1MEDIUM 6.3 Local No auth User interaction EPSS 0.00153 Published 2026-08-17 Fixed in 2026.2.1 CWE-918

TI-2026-52739 CVE-2026-75053 · GHSA-6v6x-gp82-9jqj

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

LOW 24

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0024 Published 2026-08-17 Fixed in 2026.2.1 CWE-918

TI-2026-52738 CVE-2026-75052 · GHSA-jx69-9f6w-q2xj

Command injection in JetBrains IntelliJ IDEA

LOW 20

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

CVSS 3.1MEDIUM 4.4 Local No auth User interaction EPSS 0.00175 Published 2026-08-17 Fixed in 2026.2.1 CWE-77

TI-2026-46344 CVE-2026-64815 · GHSA-r2fm-vv3h-4qf2

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

MEDIUM 43

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00482 Published 2026-07-23 Fixed in 2026.2 CWE-94

TI-2026-46343 CVE-2026-64814 · GHSA-893f-8w7m-vh3c

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

MEDIUM 43

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00394 Published 2026-07-23 Fixed in 2026.2 CWE-862

TI-2026-46342 CVE-2026-64813 · GHSA-7xqr-wvrf-3jr9

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

MEDIUM 49

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00522 Published 2026-07-23 Fixed in 2026.2 CWE-602

TI-2026-46341 CVE-2026-64812 · GHSA-995f-8qgf-h52p

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

MEDIUM 49

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00483 Published 2026-07-23 Fixed in 2026.2 CWE-306

TI-2026-46340 CVE-2026-64811 · GHSA-pjq3-x359-m2pf

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before…

LOW 35

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00185 Published 2026-07-23 Fixed in 2026.2 CWE-829

TI-2026-46339 CVE-2026-64810 · GHSA-3rwj-4395-cj7h

Cross-site scripting in JetBrains IntelliJ IDEA

LOW 27

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00253 Published 2026-07-23 Fixed in 2026.2 CWE-79

TI-2026-42614 CVE-2026-59792 · GHSA-6f7v-4c46-hrp4

Path traversal in JetBrains IntelliJ IDEA

MEDIUM 44

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00605 Published 2026-07-10 Fixed in 2026.1.4, 2026.2 CWE-23

TI-2026-36556 CVE-2026-49383 · GHSA-hj3g-vw9v-9wj4

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

LOW 15

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00109 Published 2026-05-29 Fixed in 2026.1 CWE-611

TI-2026-36555 CVE-2026-49382 · GHSA-fwch-gx6q-xhxg

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

LOW 33

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00135 Published 2026-05-29 Fixed in 2026.1 CWE-1336

TI-2026-36540 CVE-2026-49367 · GHSA-gjhj-r92c-v3ff

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

MEDIUM 40

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00332 Published 2026-05-29 Fixed in 2026.1.1 CWE-862

TI-2026-36539 CVE-2026-49366 · GHSA-rc87-jvvm-wgq4

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

LOW 36

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00455 Published 2026-05-29 Fixed in 2026.1.1 CWE-78

TI-2026-30286 CVE-2026-41882 · GHSA-c366-5342-rpxc

Link following in JetBrains IntelliJ IDEA

LOW 33

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00401 Published 2026-04-30 Fixed in 2024.3.7.1, 2025.1.7.1, 2025.2.6.2 +2 CWE-59

TI-2025-41845 CVE-2025-68269 · GHSA-4qgf-3m3q-8xm4

In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH

LOW 23

In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00107 Published 2025-12-16 Fixed in 2025.3 CWE-349

TI-2025-35626 CVE-2025-57730 · GHSA-rh25-hj2f-7r49

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

LOW 26

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00435 Published 2025-08-20 Fixed in 2025.2 CWE-80

TI-2025-35625 CVE-2025-57729 · GHSA-877r-cvgg-x7v6

In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

LOW 33

In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

CVSS 3.1HIGH 7.3 Local Low privileges No interaction EPSS 0.00129 Published 2025-08-20 Fixed in 2025.2 CWE-829

TI-2025-35624 CVE-2025-57728 · GHSA-7r83-p869-7995

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

LOW 28

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00247 Published 2025-08-20 Fixed in 2025.2 CWE-863

TI-2025-35623 CVE-2025-57727 · GHSA-gr4x-2wj5-g5m3

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

LOW 32

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00196 Published 2025-08-20 Fixed in 2025.2 CWE-319