93
CVEs
9
Critical
23
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
23
MEDIUM
50
LOW
11
Monthly CVE Trend
Affected Products (30)
Teamcity
255
Youtrack
177
Intellij Idea
75
Hub
36
Ktor
20
Pycharm
11
Toolbox
10
Rider
9
Open Redirect
9
Goland
8
Webstorm
8
Kotlin
6
Youtrack Mobile
6
Phpstorm
4
Upsource
4
Resharper
4
Junie
3
Jwt Attack
3
Space
3
Ssti
3
Rubymine
3
Code With Me
3
Mps
2
Kubernetes
2
Datalore
2
Dottrace
2
Node.js
2
Prototype Pollution
2
Docker
2
Java
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-106218 | Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one. | CRITICAL | 10.0 | 0.3% | 50 |
|
| CVE-2026-100255 | JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. No public exploit code has been identified at the time of analysis, but the high impact (C/I/A:H) and remote, unauthenticated attack vector make this a genuinely high-priority flaw despite thin external signals; upgrading to the specified versions removes the vulnerability. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-111094 | Remote code execution affects JetBrains TeamCity releases older than 2026.2, 2026.1.4, and 2025.11.8, where a type-whitelist bypass in the build messages protocol lets a serialized payload cross the deserialization trust boundary and execute code in the server process; the flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, unauthicated per the PR:N vector). There is no public exploit identified at time of analysis, CISA's SSVC records Exploitation as 'none' with Automatable set to 'no', and EPSS is low at 0.38% (31st percentile), though Technical Impact is rated 'total'. JetBrains has released fixes, so the primary risk is unpatched, network-reachable TeamCity servers whose agent-facing build messages channel is exposed beyond trusted build-agent hosts. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-100273 | Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an authorisation bypass in the scripts debugger, a CVSS 3.1 9.8 flaw (PR:N/UI:N, scope unchanged, confidentiality/integrity/availability all High). Real-world urgency is low despite the score: EPSS is 0.36% (28th percentile), no public exploit code has been identified at time of analysis, CISA SSVC reports Exploitation: none, and there is no KEV listing. Exposure depends on deployment - the debugger endpoint being unreachable, behind an authenticating proxy, or disabled materially lowers risk - and a vendor fix is available in 2026.2.19197. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-86478 | Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-100277 | Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notification signature, allowing an attacker who has captured a legitimate signature to authenticate as the associated account. Every YouTrack instance running an earlier build is affected (CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), and the root cause is an incorrect-authorization flaw (CWE-863) rather than memory corruption. The practical barrier is signature acquisition: our assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (high, not the input's 9.8 critical) because exploitation depends on capturing or observing a victim's notification signature rather than a blind unauthenticated request against a default install. No public exploit code and no confirmed active exploitation have been identified (EPSS 0.33%, 24th percentile; CISA SSVC lists Exploitation: none), and JetBrains has released a fix in 2026.2.19197. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-108474 | SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-86480 | Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-75045 | Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 allows a remote attacker to abuse a shared draft signature to download full database backups without any credentials. Because backups typically contain issue data, user records, and secrets, this is a high-impact confidentiality exposure. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.1 rating and trivial network exploitability make it a priority patch. | CRITICAL | 9.1 | 0.3% | 46 |
|
| CVE-2026-100254 | Command execution on Windows-based JetBrains TeamCity servers allows authenticated users with Pipeline Git connection configuration privileges to run arbitrary OS commands via CRLF injection in connection settings, affecting versions before 2026.2, 2026.1.4, and 2025.11.8. The flaw requires authentication (PR:L per CVSS) and only impacts Windows deployments; no public exploit code has been identified at time of analysis. With a CVSS score of 8.8, successful exploitation grants high confidentiality, integrity, and availability impact. | HIGH | 8.8 | 0.7% | 45 |
|
| CVE-2026-100253 | Remote code execution in JetBrains TeamCity (CVE-2026-100253) lets an authenticated attacker with permission to edit a project's versioned settings escape the Kotlin DSL sandbox and execute code on the TeamCity server. Affected versions are those before 2026.2, before 2026.1.4, and before 2025.11.8. No public exploit identified at time of analysis, but this is a genuine high-priority issue rather than an inflated CVSS score because it can compromise a CI/CD server; exploitation requires a low-privileged, non-anonymous account able to supply or commit malicious Kotlin DSL settings. | HIGH | 8.8 | 0.6% | 45 |
|
| CVE-2026-86482 | Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-86492 | Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 0.6% | 43 |
|
| CVE-2026-75060 | Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. Any local attacker able to reach the MCP endpoint can trigger arbitrary code execution with the privileges of the running PyCharm process, achieving full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis. | HIGH | 8.4 | 0.1% | 42 |
|
| CVE-2026-86502 | Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to the IJent gRPC server running without TLS encryption or any authentication mechanism. The IJent agent, deployed on remote hosts when the Remote Development feature is in use, accepts connections from any local process without requiring credentials, enabling arbitrary command execution under the agent's security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 8.4 | 0.1% | 42 |
|