76
CVEs
14
Critical
26
High
1
KEV
1
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
14
HIGH
26
MEDIUM
28
LOW
8
Monthly CVE Trend
Affected Products (30)
Teamcity
246
Youtrack
136
Intellij Idea
74
Hub
35
Ktor
20
Pycharm
11
Toolbox
10
Open Redirect
9
Rider
8
Goland
8
Webstorm
8
Youtrack Mobile
6
Kotlin
6
Resharper
4
Upsource
4
Phpstorm
4
Jwt Attack
3
Ssti
3
Rubymine
3
Space
3
Junie
3
Code With Me
3
Mps
2
Docker
2
Kubernetes
2
Dottrace
2
Node.js
2
Java
2
Prototype Pollution
2
Ideavim
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-63077 | Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis. | CRITICAL | 9.8 | 0.6% | 135 |
KEV
PoC
|
| CVE-2026-65906 | Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sandbox used to define build configurations-as-code and run arbitrary code in the context of the CI server. Because TeamCity servers hold VCS credentials, deployment keys, and build artifacts, a successful escape effectively compromises the entire build pipeline and downstream software supply chain. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS is low at 0.40% (33rd percentile). | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-64813 | Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-64812 | Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to inject unauthorized input into an active Remote Development session, undermining the trust boundary between client and backend host. Because the flaw stems from missing authentication (CWE-306) on a Remote Development channel and carries a maximal CVSS 10.0 with scope change, a successful attacker can influence code, files, or execution on the remote workspace. There is no public exploit identified at time of analysis, but the ceiling severity warrants prompt patching. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-50242 | Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other JetBrains tools) lets an actor obtain administrative access by going through direct database access, per JetBrains' own advisory. Classified under CWE-306 (Missing Authentication for a Critical Function) and vendor-scored CVSS 9.8, it affects all builds before the fixed 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 releases. There is no public exploit identified at time of analysis and the EPSS probability is low (0.44%, 35th percentile), but full administrative compromise is the stated technical impact. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-59792 | Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper sanitization of the project workspace ID to write or reference files outside the intended workspace directory, culminating in arbitrary code execution. The flaw was self-reported by JetBrains and a fix is available; no public exploit has been identified at time of analysis. The NVD-assigned CVSS of 9.8 (network, no privileges, no user interaction) is notably high for a desktop IDE flaw and warrants scrutiny given that IDE project-handling bugs typically require a victim to open a crafted project. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-56141 | Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429. Remote unauthenticated attackers can guess or predict the restore codes used for account recovery, enabling them to seize control of arbitrary user accounts. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects the high impact of full account compromise across an identity management platform. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-86478 | Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-62422 | Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct-database-access code path, per CWE-306 (missing authentication for a critical function). All self-hosted YouTrack builds prior to the 2026.1.13757 / 2025.3.148033 / 2025.2.148048 / 2025.1.148120 / 2024.3.148430 / 2024.2.148429 fix trains are affected, and JetBrains rates it CVSS 10.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity score and administrative impact make prompt patching essential. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-64815 | Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by convincing a developer to open a malicious UI Designer form file, leading to full system compromise. No active exploitation or public exploit code has been reported, but a critical-severity vendor patch is available. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-86480 | Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-65907 | Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains. | CRITICAL | 9.1 | 0.4% | 46 |
|
| CVE-2026-56142 | Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429) allows an authenticated attacker to attach additional authentication details to existing accounts, enabling unauthorized access and elevation of privileges. The flaw, self-reported by JetBrains and patched, carries a CVSS 8.8 with high impact to confidentiality, integrity, and availability; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.41%). | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-59793 | Arbitrary file access in JetBrains TeamCity before 2026.1.2 lets an authenticated user abuse the Perforce (P4) VCS integration to read files outside intended boundaries on the TeamCity server host. The flaw (CWE-73, external control of file name or path) was self-reported by JetBrains and is fixed in 2026.1.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With PR:L in the CVSS vector, exploitation requires a low-privilege account that can define or influence a Perforce VCS root, making it a realistic post-authentication threat on shared CI servers. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-86482 | Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance. | HIGH | 8.8 | 0.2% | 44 |
|