47
CVEs
6
Critical
11
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
11
MEDIUM
26
LOW
4
Monthly CVE Trend
Affected Products (30)
Teamcity
255
Youtrack
177
Intellij Idea
75
Hub
36
Ktor
20
Pycharm
11
Toolbox
10
Rider
9
Open Redirect
9
Goland
8
Webstorm
8
Kotlin
6
Youtrack Mobile
6
Phpstorm
4
Upsource
4
Resharper
4
Junie
3
Jwt Attack
3
Space
3
Ssti
3
Rubymine
3
Code With Me
3
Mps
2
Kubernetes
2
Datalore
2
Dottrace
2
Node.js
2
Prototype Pollution
2
Docker
2
Java
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-106218 | Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one. | CRITICAL | 10.0 | 0.3% | 50 |
|
| CVE-2026-100255 | JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. No public exploit code has been identified at the time of analysis, but the high impact (C/I/A:H) and remote, unauthenticated attack vector make this a genuinely high-priority flaw despite thin external signals; upgrading to the specified versions removes the vulnerability. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-111094 | Remote code execution affects JetBrains TeamCity releases older than 2026.2, 2026.1.4, and 2025.11.8, where a type-whitelist bypass in the build messages protocol lets a serialized payload cross the deserialization trust boundary and execute code in the server process; the flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, unauthicated per the PR:N vector). There is no public exploit identified at time of analysis, CISA's SSVC records Exploitation as 'none' with Automatable set to 'no', and EPSS is low at 0.38% (31st percentile), though Technical Impact is rated 'total'. JetBrains has released fixes, so the primary risk is unpatched, network-reachable TeamCity servers whose agent-facing build messages channel is exposed beyond trusted build-agent hosts. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-100273 | Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an authorisation bypass in the scripts debugger, a CVSS 3.1 9.8 flaw (PR:N/UI:N, scope unchanged, confidentiality/integrity/availability all High). Real-world urgency is low despite the score: EPSS is 0.36% (28th percentile), no public exploit code has been identified at time of analysis, CISA SSVC reports Exploitation: none, and there is no KEV listing. Exposure depends on deployment - the debugger endpoint being unreachable, behind an authenticating proxy, or disabled materially lowers risk - and a vendor fix is available in 2026.2.19197. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-100277 | Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notification signature, allowing an attacker who has captured a legitimate signature to authenticate as the associated account. Every YouTrack instance running an earlier build is affected (CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), and the root cause is an incorrect-authorization flaw (CWE-863) rather than memory corruption. The practical barrier is signature acquisition: our assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (high, not the input's 9.8 critical) because exploitation depends on capturing or observing a victim's notification signature rather than a blind unauthenticated request against a default install. No public exploit code and no confirmed active exploitation have been identified (EPSS 0.33%, 24th percentile; CISA SSVC lists Exploitation: none), and JetBrains has released a fix in 2026.2.19197. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-108474 | SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-100254 | Command execution on Windows-based JetBrains TeamCity servers allows authenticated users with Pipeline Git connection configuration privileges to run arbitrary OS commands via CRLF injection in connection settings, affecting versions before 2026.2, 2026.1.4, and 2025.11.8. The flaw requires authentication (PR:L per CVSS) and only impacts Windows deployments; no public exploit code has been identified at time of analysis. With a CVSS score of 8.8, successful exploitation grants high confidentiality, integrity, and availability impact. | HIGH | 8.8 | 0.7% | 45 |
|
| CVE-2026-100253 | Remote code execution in JetBrains TeamCity (CVE-2026-100253) lets an authenticated attacker with permission to edit a project's versioned settings escape the Kotlin DSL sandbox and execute code on the TeamCity server. Affected versions are those before 2026.2, before 2026.1.4, and before 2025.11.8. No public exploit identified at time of analysis, but this is a genuine high-priority issue rather than an inflated CVSS score because it can compromise a CI/CD server; exploitation requires a low-privileged, non-anonymous account able to supply or commit malicious Kotlin DSL settings. | HIGH | 8.8 | 0.6% | 45 |
|
| CVE-2026-103493 | Stored XSS in JetBrains YouTrack before 2026.2.19422 allows an authenticated user with content-creation rights to inject malicious Mermaid or LaTeX markup that executes in the browser of any user who views the affected issue, comment, or similar content. The vendor CVSS is 8.1, but the independent assessment lowers this to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting required authentication (unless anonymous/guest issue reporting is enabled), victim interaction, and low confidentiality/integrity impact; signals lean toward moderate real-world priority. No public exploit code or CISA KEV active exploitation was identified at time of analysis. | HIGH | 8.1 | 0.2% | 40 |
|
| CVE-2026-100256 | Local code execution in JetBrains IntelliJ IDEA before 2026.2.3 is possible when a developer opens an attacker-supplied untrusted project, because malicious Structural Search script constraints then run within the IDE. The flaw is assessed as CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is local and requires the victim to open the project, but no target authentication is needed and default configurations are affected once that action occurs. No public exploit or confirmed active exploitation was identified at time of analysis; the risk is real but gated by social engineering and the local attack vector. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-111091 | Code execution in JetBrains Junie CLI before 26.8.3 allows an attacker to run arbitrary code via a malicious MCP server configuration embedded in an untrusted project. The victim must open and interact with the project (user interaction required), and local access is necessary, but no privileges are required. No public exploit code has been identified at time of analysis. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-106219 | Information disclosure in JetBrains TeamCity before 2026.2.1 allows a crafted Git submodule URL to make the server read files from local repositories reachable by the TeamCity service account, exposing source code and other local repository contents. The supplied NVD vector rates this as network-reachable without privileges (PR:N), but our assessment applies a low-privileged precondition (PR:L), because the attacker must be able to influence a submodule URL - typically by committing a malicious .gitmodules file to a repository TeamCity checks out, or by controlling a VCS root - on an instance configured to resolve Git submodules. Impact is confidentiality-only with no integrity or availability effect; EPSS is low (0.62%, 48th percentile), SSVC records no exploitation activity, and no public exploit code has been identified at time of analysis. | HIGH | 7.5 | 0.6% | 38 |
|
| CVE-2026-100276 | Incorrect authorization in JetBrains YouTrack before version 2026.2.19197 allows guest users to strip a workflow action's visibility restriction and then execute that action, altering workflow behavior on the instance. The flaw is network-reachable and rated CVSS 7.5 with a PR:N vector, though practical exposure depends on guest access being enabled on the target instance - a configuration in which the guest context supplies the effective precondition; disabling guest access removes the attack surface entirely. Impact is limited to integrity of workflow actions (no confidentiality or availability effect), there is no public exploit identified at time of analysis, EPSS is low (0.29%, roughly 19th percentile), CISA SSVC records exploitation status as none, and the vendor has released a patch in 2026.2.19197. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-111093 | Unauthenticated path traversal in the report blob endpoint of JetBrains Datalore before version 2026.2.1 allows a remote attacker who can reach the service to read arbitrary files accessible to the Datalore process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH), exploitation requires no credentials and no user interaction, making exposure the primary limiting factor: only network-reachable instances below 2026.2.1 are at risk, and the flaw yields confidentiality loss only, with no integrity or availability impact and no code execution on its own. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low-complexity, unauthenticated nature of the bug makes it an attractive target for opportunistic scanning of internet-facing deployments. | HIGH | 7.5 | 0.4% | 38 |
|
| CVE-2026-103490 | Privilege escalation in JetBrains YouTrack lets an authenticated holder of an already-high-privilege (non-admin) account raise their effective permissions by abusing the user group links functionality, where a required authorization check is missing (CWE-862). All YouTrack releases before 2026.2.19422 are affected, and the issue is scored CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact once triggered, requiring no user interaction. The PR:H prerequisite meaningfully bounds exposure - anonymous or fully unprivileged users cannot exploit it - and there is no public exploit identified at time of analysis, making this a real but gated finding rather than an urgent fire-drill. | HIGH | 7.2 | 0.4% | 36 |
|