By year
15
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited JetBrains flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted DataExploited since Aug 5, 2026 · ransomware · CVSS 9.8
- CVE-2024-27199 JetBrains TeamCity Relative Path TraversalExploited since Apr 20, 2026 · ransomware · CVSS 7.3
- CVE-2024-27198 JetBrains TeamCity Authentication BypassExploited since Mar 7, 2024 · ransomware · CVSS 9.8
- CVE-2023-42793 JetBrains TeamCity Authentication BypassExploited since Oct 4, 2023 · ransomware · CVSS 9.8
Latest high and critical flaws
- CVE-2026-111095 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possibleHigh 8 · Oct 15, 2026
- CVE-2026-111094 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possibleHigh 8.1 · Oct 15, 2026
- CVE-2026-111093 In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary filesHigh 7.5 · Oct 15, 2026
- CVE-2026-111091 In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configurationHigh 7.8 · Oct 15, 2026
- CVE-2026-108474 In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsCritical 9.8 · Oct 9, 2026
- CVE-2026-106218 In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possibleHigh 8.8 · Oct 6, 2026
- CVE-2026-103493 In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possibleHigh 8.1 · Oct 1, 2026
- CVE-2026-103490 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksHigh 7.2 · Oct 1, 2026
- CVE-2026-103488 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issuesHigh 7.1 · Oct 1, 2026
- CVE-2026-100277 In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signatureHigh 8.9 · Sep 30, 2026
- CVE-2026-100273 In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code executionHigh 8.2 · Sep 30, 2026
- CVE-2026-100268 In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templatesHigh 7.7 · Sep 30, 2026
- CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted addressHigh 7.7 · Sep 30, 2026
- CVE-2026-100262 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templatesHigh 7.6 · Sep 30, 2026
- CVE-2026-100256 In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projectsHigh 7.8 · Sep 30, 2026
- CVE-2026-100255 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password resetHigh 8.1 · Sep 30, 2026
- CVE-2026-100254 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connHigh 8.8 · Sep 30, 2026
- CVE-2026-100253 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSLHigh 8.8 · Sep 30, 2026
- CVE-2026-86504 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code executionHigh 7.8 · Sep 7, 2026
- CVE-2026-86502 In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hostsHigh 8.4 · Sep 7, 2026
- CVE-2026-86498 In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permissionHigh 7.7 · Sep 7, 2026
- CVE-2026-86494 In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issuesHigh 7.7 · Sep 7, 2026
- CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokensHigh 8.5 · Sep 7, 2026
- CVE-2026-86482 In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalationHigh 8.8 · Sep 7, 2026
- CVE-2026-86480 In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privilegesCritical 9.8 · Sep 7, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.