38
CVEs
2
Critical
9
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
9
MEDIUM
20
LOW
7
Monthly CVE Trend
Affected Products (30)
Teamcity
246
Youtrack
136
Intellij Idea
74
Hub
35
Ktor
20
Pycharm
11
Toolbox
10
Open Redirect
9
Rider
8
Goland
8
Webstorm
8
Youtrack Mobile
6
Kotlin
6
Resharper
4
Upsource
4
Phpstorm
4
Jwt Attack
3
Ssti
3
Rubymine
3
Space
3
Junie
3
Code With Me
3
Mps
2
Docker
2
Kubernetes
2
Dottrace
2
Node.js
2
Java
2
Prototype Pollution
2
Ideavim
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86478 | Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-86480 | Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-86482 | Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-86492 | Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 0.6% | 43 |
|
| CVE-2026-75060 | Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. Any local attacker able to reach the MCP endpoint can trigger arbitrary code execution with the privileges of the running PyCharm process, achieving full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis. | HIGH | 8.4 | 0.1% | 42 |
|
| CVE-2026-86502 | Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to the IJent gRPC server running without TLS encryption or any authentication mechanism. The IJent agent, deployed on remote hosts when the Remote Development feature is in use, accepts connections from any local process without requiring credentials, enabling arbitrary command execution under the agent's security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 8.4 | 0.1% | 42 |
|
| CVE-2026-86479 | Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privileged users to access and modify restricted resources via Insecure Direct Object Reference (IDOR). Affected versions span all YouTrack releases prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 across three active release branches. An attacker with any valid account can enumerate or directly reference object identifiers in REST API calls to read or write data they should not have access to, with high confidentiality and integrity impact per the CVSS vector. | HIGH | 8.1 | 0.2% | 41 |
|
| CVE-2026-75056 | Remote code execution in JetBrains IntelliJ IDEA before version 2026.2.1 is achievable through the Markdown export tool via OS command injection. An attacker who can deliver a crafted Markdown file to a developer and induce them to export it can execute arbitrary operating system commands in the context of the IntelliJ IDEA process. No public exploit or CISA KEV listing has been identified at time of analysis, but the CWE-78 root cause and full C/H/I/H/A:H impact make this a meaningful risk for development workstation environments. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-86504 | Host-level code execution in JetBrains IntelliJ IDEA before 2026.2.2 is triggered when a developer opens a malicious project containing a crafted Dev Container configuration, which the IDE proceeds to build without first requesting the standard project-trust confirmation. The flaw (CWE-829) allows untrusted, project-defined container build scripts and Docker commands to execute directly on the developer's host machine, bypassing the IDE's safety gate. JetBrains confirmed the issue and released a fix in version 2026.2.2; no public exploit has been identified at time of analysis. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-86494 | Unauthorized integrity modification in JetBrains YouTrack before 2026.2.18634 allows any authenticated low-privilege user to alter links on issues they are explicitly prohibited from accessing by exploiting the whiteboard clone operation. The whiteboard clone workflow fails to validate the cloning user's authorization against issues referenced in the board, enabling cross-boundary write access governed by CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis, but the CVSS 7.7 vector (S:C, I:H, PR:L, AC:L) accurately reflects the low barrier to exploitation and the cross-domain integrity impact. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-86498 | Incorrect authorization in JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 allows authenticated low-privilege users to modify linked issue entities they lack update permission on by issuing PUT requests directly to link sub-resources. The flaw bypasses YouTrack's permission model at the HTTP method level, enabling integrity violations across project boundaries-reflected in the CVSS scope change (S:C). No public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-86497 | Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog. | MEDIUM | 6.8 | 0.3% | 34 |
|
| CVE-2026-86488 | Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 33 |
|
| CVE-2026-86489 | Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments. | MEDIUM | 6.5 | 0.2% | 33 |
|
| CVE-2026-86490 | Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 33 |
|