600
CVEs
61
Critical
173
High
4
KEV
12
PoC
174
Unpatched C/H
21.7%
Patch Rate
1.8%
Avg EPSS
Severity Breakdown
CRITICAL
61
HIGH
173
MEDIUM
335
LOW
31
Monthly CVE Trend
Affected Products (30)
Teamcity
246
Youtrack
144
Intellij Idea
74
Hub
35
Ktor
20
Pycharm
11
Toolbox
10
Open Redirect
9
Rider
8
Goland
8
Webstorm
8
Youtrack Mobile
6
Kotlin
6
Resharper
4
Upsource
4
Phpstorm
4
Jwt Attack
3
Ssti
3
Rubymine
3
Space
3
Junie
3
Code With Me
3
Mps
2
Docker
2
Kubernetes
2
Dottrace
2
Node.js
2
Java
2
Prototype Pollution
2
Ideavim
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2024-27199 | Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrative actions by bypassing authentication controls on specific endpoints. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and carries an EPSS score of 82.47% (99th percentile), placing it among the highest-probability exploitation targets currently tracked. | HIGH | 7.3 | 82.5% | 189 |
KEV
PoC
No patch
|
| CVE-2026-63077 | Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis. | CRITICAL | 9.8 | 0.6% | 135 |
KEV
PoC
|
| CVE-2023-42793 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 100.0% | 84 |
KEV
PoC
No patch
|
| CVE-2024-27198 | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 99.9% | 84 |
KEV
PoC
No patch
|
| CVE-2024-23917 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 53.7% | 69 |
PoC
No patch
|
| CVE-2019-10101 | JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 1.6% | 60 |
PoC
No patch
|
| CVE-2020-11694 | In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 1.8% | 58 |
PoC
No patch
|
| CVE-2019-19703 | In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.6% | 50 |
PoC
|
| CVE-2026-65906 | Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sandbox used to define build configurations-as-code and run arbitrary code in the context of the CI server. Because TeamCity servers hold VCS credentials, deployment keys, and build artifacts, a successful escape effectively compromises the entire build pipeline and downstream software supply chain. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS is low at 0.40% (33rd percentile). | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-64813 | Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-64812 | Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to inject unauthorized input into an active Remote Development session, undermining the trust boundary between client and backend host. Because the flaw stems from missing authentication (CWE-306) on a Remote Development channel and carries a maximal CVSS 10.0 with scope change, a successful attacker can influence code, files, or execution on the remote workspace. There is no public exploit identified at time of analysis, but the ceiling severity warrants prompt patching. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-50242 | Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other JetBrains tools) lets an actor obtain administrative access by going through direct database access, per JetBrains' own advisory. Classified under CWE-306 (Missing Authentication for a Critical Function) and vendor-scored CVSS 9.8, it affects all builds before the fixed 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 releases. There is no public exploit identified at time of analysis and the EPSS probability is low (0.44%, 35th percentile), but full administrative compromise is the stated technical impact. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-59792 | Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper sanitization of the project workspace ID to write or reference files outside the intended workspace directory, culminating in arbitrary code execution. The flaw was self-reported by JetBrains and a fix is available; no public exploit has been identified at time of analysis. The NVD-assigned CVSS of 9.8 (network, no privileges, no user interaction) is notably high for a desktop IDE flaw and warrants scrutiny given that IDE project-handling bugs typically require a victim to open a crafted project. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-56141 | Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429. Remote unauthenticated attackers can guess or predict the restore codes used for account recovery, enabling them to seize control of arbitrary user accounts. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects the high impact of full account compromise across an identity management platform. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-86478 | Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.4% | 49 |
|