{"schema_version":1,"title":"Jetbrains vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 112 vulnerabilities in Jetbrains: 1 in the last 7 days and 75 in the last 90 days, 15 of them critical and 4 exploited in the wild. The most recent, CVE-2026-52742, was published on 21 September 2026. 7 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/jetbrains","json_url":"https://junglewise.ai/threats/vendors/jetbrains.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/jetbrains","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":39,"all_time":112,"critical":15,"exploited":4,"last_7_days":1,"last_30_days":30,"last_90_days":75,"last_365_days":110},"latest":[{"cve":"CVE-2026-52742","epss":0.0052,"slug":"cve-2026-52742-gocd-is-a-continuous-deliver-server-from-12-3-1-until-26-1-0","title":"GoCD authorization bypass in legacy REST API configuration endpoints","severity":"info","exploited":false,"published_at":"2026-09-21T15:17:28.79+00:00","url":"https://junglewise.ai/threats/cve-2026-52742-gocd-is-a-continuous-deliver-server-from-12-3-1-until-26-1-0"},{"cve":"CVE-2026-86506","cvss":5.9,"epss":0.0038,"slug":"cve-2026-86506-jetbrains-goland-missing-authentication-in-profiler-s-pprof","title":"JetBrains GoLand missing authentication in profiler's pprof server","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:29.13+00:00","url":"https://junglewise.ai/threats/cve-2026-86506-jetbrains-goland-missing-authentication-in-profiler-s-pprof"},{"cve":"CVE-2026-86505","cvss":3.3,"epss":0.0015,"slug":"cve-2026-86505-jetbrains-intellij-idea-project-metadata-disclosure-to","title":"JetBrains IntelliJ IDEA project metadata disclosure to marketplace","severity":"low","exploited":false,"published_at":"2026-09-07T17:17:29.02+00:00","url":"https://junglewise.ai/threats/cve-2026-86505-jetbrains-intellij-idea-project-metadata-disclosure-to"},{"cve":"CVE-2026-86504","cvss":7.8,"epss":0.0019,"slug":"cve-2026-86504-jetbrains-intellij-idea-dev-container-code-execution-via-missing","title":"JetBrains IntelliJ IDEA Dev Container code execution via missing trust confirmation","severity":"high","exploited":false,"published_at":"2026-09-07T17:17:28.903+00:00","url":"https://junglewise.ai/threats/cve-2026-86504-jetbrains-intellij-idea-dev-container-code-execution-via-missing"},{"cve":"CVE-2026-86503","cvss":3.3,"epss":0.0015,"slug":"cve-2026-86503-jetbrains-intellij-idea-ssrf-in-kubernetes-spec-source-url","title":"JetBrains IntelliJ IDEA SSRF in Kubernetes spec-source URL fetching","severity":"low","exploited":false,"published_at":"2026-09-07T17:17:28.783+00:00","url":"https://junglewise.ai/threats/cve-2026-86503-jetbrains-intellij-idea-ssrf-in-kubernetes-spec-source-url"},{"cve":"CVE-2026-86502","cvss":8.4,"epss":0.0021,"slug":"cve-2026-86502-jetbrains-intellij-idea-missing-tls-and-authentication-in-ijent","title":"JetBrains IntelliJ IDEA missing TLS and authentication in IJent gRPC server","severity":"high","exploited":false,"published_at":"2026-09-07T17:17:28.67+00:00","url":"https://junglewise.ai/threats/cve-2026-86502-jetbrains-intellij-idea-missing-tls-and-authentication-in-ijent"},{"cve":"CVE-2026-86501","cvss":2.8,"epss":0.0039,"slug":"cve-2026-86501-jetbrains-intellij-idea-information-disclosure-in-terminal","title":"JetBrains IntelliJ IDEA information disclosure in terminal logging","severity":"low","exploited":false,"published_at":"2026-09-07T17:17:28.56+00:00","url":"https://junglewise.ai/threats/cve-2026-86501-jetbrains-intellij-idea-information-disclosure-in-terminal"},{"cve":"CVE-2026-86500","cvss":5.5,"epss":0.0027,"slug":"cve-2026-86500-jetbrains-youtrack-privilege-escalation-in-project-permissions","title":"JetBrains YouTrack privilege escalation in project permissions","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:28.443+00:00","url":"https://junglewise.ai/threats/cve-2026-86500-jetbrains-youtrack-privilege-escalation-in-project-permissions"},{"cve":"CVE-2026-86499","cvss":4.3,"epss":0.0027,"slug":"cve-2026-86499-jetbrains-youtrack-information-disclosure-in-predefined-search","title":"JetBrains YouTrack information disclosure in predefined search fields","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:28.33+00:00","url":"https://junglewise.ai/threats/cve-2026-86499-jetbrains-youtrack-information-disclosure-in-predefined-search"},{"cve":"CVE-2026-86498","cvss":7.7,"epss":0.003,"slug":"cve-2026-86498-jetbrains-youtrack-authorization-bypass-in-link-resources","title":"JetBrains YouTrack authorization bypass in link resources","severity":"high","exploited":false,"published_at":"2026-09-07T17:17:28.22+00:00","url":"https://junglewise.ai/threats/cve-2026-86498-jetbrains-youtrack-authorization-bypass-in-link-resources"},{"cve":"CVE-2026-86497","cvss":6.8,"epss":0.0051,"slug":"cve-2026-86497-jetbrains-youtrack-mailbox-credential-exfiltration","title":"JetBrains YouTrack mailbox credential exfiltration","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:28.097+00:00","url":"https://junglewise.ai/threats/cve-2026-86497-jetbrains-youtrack-mailbox-credential-exfiltration"},{"cve":"CVE-2026-86496","cvss":4.3,"epss":0.0028,"slug":"cve-2026-86496-jetbrains-youtrack-missing-access-control-on-helpdesk-authorized","title":"JetBrains YouTrack missing access control on Helpdesk authorized reporters","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:27.987+00:00","url":"https://junglewise.ai/threats/cve-2026-86496-jetbrains-youtrack-missing-access-control-on-helpdesk-authorized"},{"cve":"CVE-2026-86495","cvss":6.5,"epss":0.0033,"slug":"cve-2026-86495-jetbrains-youtrack-missing-permission-checks-in-knowledge-base","title":"JetBrains YouTrack missing permission checks in knowledge base","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:27.867+00:00","url":"https://junglewise.ai/threats/cve-2026-86495-jetbrains-youtrack-missing-permission-checks-in-knowledge-base"},{"cve":"CVE-2026-86494","cvss":7.7,"epss":0.003,"slug":"cve-2026-86494-jetbrains-youtrack-unauthorized-link-modification-via-whiteboard","title":"JetBrains YouTrack unauthorized link modification via whiteboard clone","severity":"high","exploited":false,"published_at":"2026-09-07T17:17:27.753+00:00","url":"https://junglewise.ai/threats/cve-2026-86494-jetbrains-youtrack-unauthorized-link-modification-via-whiteboard"},{"cve":"CVE-2026-86493","cvss":6.5,"epss":0.003,"slug":"cve-2026-86493-jetbrains-youtrack-privilege-escalation-in-whiteboard-cards","title":"JetBrains YouTrack privilege escalation in whiteboard cards","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:27.627+00:00","url":"https://junglewise.ai/threats/cve-2026-86493-jetbrains-youtrack-privilege-escalation-in-whiteboard-cards"},{"cve":"CVE-2026-86492","cvss":8.5,"epss":0.009,"slug":"cve-2026-86492-jetbrains-youtrack-cross-tenant-github-app-token-theft","title":"JetBrains YouTrack cross-tenant GitHub App token theft","severity":"high","exploited":false,"published_at":"2026-09-07T17:17:27.517+00:00","url":"https://junglewise.ai/threats/cve-2026-86492-jetbrains-youtrack-cross-tenant-github-app-token-theft"},{"cve":"CVE-2026-86491","cvss":3.5,"epss":0.0024,"slug":"cve-2026-86491-jetbrains-youtrack-stored-xss-in-icon-uploads","title":"JetBrains YouTrack stored XSS in icon uploads","severity":"low","exploited":false,"published_at":"2026-09-07T17:17:27.397+00:00","url":"https://junglewise.ai/threats/cve-2026-86491-jetbrains-youtrack-stored-xss-in-icon-uploads"},{"cve":"CVE-2026-86490","cvss":6.5,"epss":0.0033,"slug":"cve-2026-86490-jetbrains-youtrack-improper-permission-checks-in-app-import","title":"JetBrains YouTrack improper permission checks in app import","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:27.28+00:00","url":"https://junglewise.ai/threats/cve-2026-86490-jetbrains-youtrack-improper-permission-checks-in-app-import"},{"cve":"CVE-2026-86489","cvss":6.5,"epss":0.0034,"slug":"cve-2026-86489-jetbrains-youtrack-idor-in-user-profile-api","title":"JetBrains YouTrack IDOR in user profile API","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:27.167+00:00","url":"https://junglewise.ai/threats/cve-2026-86489-jetbrains-youtrack-idor-in-user-profile-api"},{"cve":"CVE-2026-86488","cvss":6.5,"epss":0.0034,"slug":"cve-2026-86488-jetbrains-youtrack-insecure-direct-object-reference-in-watchrules","title":"JetBrains YouTrack insecure direct object reference in watchRules and issueListConfig","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:27.053+00:00","url":"https://junglewise.ai/threats/cve-2026-86488-jetbrains-youtrack-insecure-direct-object-reference-in-watchrules"},{"cve":"CVE-2026-86487","cvss":3.1,"epss":0.002,"slug":"cve-2026-86487-jetbrains-youtrack-websocket-privilege-escalation-in-whiteboard","title":"JetBrains YouTrack WebSocket privilege escalation in whiteboard","severity":"low","exploited":false,"published_at":"2026-09-07T17:17:26.947+00:00","url":"https://junglewise.ai/threats/cve-2026-86487-jetbrains-youtrack-websocket-privilege-escalation-in-whiteboard"},{"cve":"CVE-2026-86486","cvss":3.7,"epss":0.0026,"slug":"cve-2026-86486-jetbrains-youtrack-vcs-webhook-authentication-bypass","title":"JetBrains YouTrack VCS webhook authentication bypass","severity":"low","exploited":false,"published_at":"2026-09-07T17:17:26.83+00:00","url":"https://junglewise.ai/threats/cve-2026-86486-jetbrains-youtrack-vcs-webhook-authentication-bypass"},{"cve":"CVE-2026-86485","cvss":3.3,"epss":0.0016,"slug":"cve-2026-86485-jetbrains-youtrack-ip-spoofing-via-http-headers-in-bitbucket","title":"JetBrains YouTrack IP spoofing via HTTP headers in Bitbucket webhook validation","severity":"low","exploited":false,"published_at":"2026-09-07T17:17:26.723+00:00","url":"https://junglewise.ai/threats/cve-2026-86485-jetbrains-youtrack-ip-spoofing-via-http-headers-in-bitbucket"},{"cve":"CVE-2026-86484","cvss":4.6,"epss":0.0064,"slug":"cve-2026-86484-jetbrains-youtrack-stored-xss-in-assignee-names-via-angularjs","title":"JetBrains YouTrack stored XSS in assignee names via AngularJS template injection","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:26.607+00:00","url":"https://junglewise.ai/threats/cve-2026-86484-jetbrains-youtrack-stored-xss-in-assignee-names-via-angularjs"},{"cve":"CVE-2026-86483","cvss":5.4,"epss":0.0064,"slug":"cve-2026-86483-jetbrains-youtrack-stored-xss-in-custom-field-on-agile-board","title":"JetBrains YouTrack stored XSS in custom field on Agile board","severity":"medium","exploited":false,"published_at":"2026-09-07T17:17:26.5+00:00","url":"https://junglewise.ai/threats/cve-2026-86483-jetbrains-youtrack-stored-xss-in-custom-field-on-agile-board"}],"vendor":{"hub":true,"name":"Jetbrains","slug":"jetbrains","homepage":"https://www.jetbrains.com/","description":"A software development company that produces integrated development environments and developer productivity tools.","url":"https://junglewise.ai/threats/vendors/jetbrains"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":1,"exploited":0,"vulnerabilities":7},{"week":"2026-07-13","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":3,"exploited":0,"vulnerabilities":18},{"week":"2026-07-27","critical":1,"exploited":1,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":1,"exploited":0,"vulnerabilities":18},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":2,"exploited":0,"vulnerabilities":29},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"most_severe":[{"cve":"CVE-2026-63077","cvss":9.8,"epss":0.0065,"slug":"cve-2026-63077-jetbrains-teamcity-remote-code-execution-in-agent-polling","title":"JetBrains TeamCity remote code execution in agent polling protocol","severity":"critical","exploited":true,"published_at":"2026-07-27T17:16:38.83+00:00","url":"https://junglewise.ai/threats/cve-2026-63077-jetbrains-teamcity-remote-code-execution-in-agent-polling"},{"cve":"CVE-2024-27198","cvss":9.8,"slug":"cve-2024-27198-jetbrains-teamcity-authentication-bypass-vulnerability","title":"JetBrains TeamCity Authentication Bypass Vulnerability","severity":"critical","exploited":true,"published_at":"2024-03-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-27198-jetbrains-teamcity-authentication-bypass-vulnerability"},{"cve":"CVE-2023-42793","cvss":9.8,"slug":"cve-2023-42793-jetbrains-teamcity-authentication-bypass-vulnerability","title":"JetBrains TeamCity Authentication Bypass Vulnerability","severity":"critical","exploited":true,"published_at":"2023-10-04T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-42793-jetbrains-teamcity-authentication-bypass-vulnerability"},{"cve":"CVE-2024-27199","cvss":7.3,"epss":0.9093,"slug":"cve-2024-27199-jetbrains-teamcity-relative-path-traversal-in-admin-interface","title":"JetBrains TeamCity relative path traversal in admin interface","severity":"critical","exploited":true,"published_at":"2026-04-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-27199-jetbrains-teamcity-relative-path-traversal-in-admin-interface"},{"cve":"CVE-2026-64813","cvss":10,"slug":"cve-2026-64813-jetbrains-intellij-idea-unauthorized-settings-modification-in","title":"JetBrains IntelliJ IDEA unauthorized settings modification in Remote Development","severity":"critical","exploited":false,"published_at":"2026-07-23T12:18:36.897+00:00","url":"https://junglewise.ai/threats/cve-2026-64813-jetbrains-intellij-idea-unauthorized-settings-modification-in"},{"cve":"CVE-2026-64812","cvss":10,"slug":"cve-2026-64812-jetbrains-intellij-idea-unauthorized-input-injection-in-remote","title":"JetBrains IntelliJ IDEA unauthorized input injection in Remote Development session","severity":"critical","exploited":false,"published_at":"2026-07-23T12:18:36.783+00:00","url":"https://junglewise.ai/threats/cve-2026-64812-jetbrains-intellij-idea-unauthorized-input-injection-in-remote"},{"cve":"CVE-2026-62422","cvss":10,"slug":"cve-2026-62422-jetbrains-youtrack-authentication-bypass-via-direct-database","title":"JetBrains YouTrack authentication bypass via direct database access","severity":"critical","exploited":false,"published_at":"2026-07-14T11:16:48.367+00:00","url":"https://junglewise.ai/threats/cve-2026-62422-jetbrains-youtrack-authentication-bypass-via-direct-database"},{"cve":"CVE-2026-50242","cvss":10,"slug":"cve-2026-50242-jetbrains-hub-authentication-bypass-leading-to-administrative","title":"JetBrains Hub authentication bypass leading to administrative access","severity":"critical","exploited":false,"published_at":"2026-06-19T13:16:36.987+00:00","url":"https://junglewise.ai/threats/cve-2026-50242-jetbrains-hub-authentication-bypass-leading-to-administrative"},{"cve":"CVE-2026-56142","cvss":9.9,"slug":"cve-2026-56142-jetbrains-hub-privilege-escalation-via-authentication-detail","title":"JetBrains Hub privilege escalation via authentication detail attachment","severity":"critical","exploited":false,"published_at":"2026-06-19T13:16:37.313+00:00","url":"https://junglewise.ai/threats/cve-2026-56142-jetbrains-hub-privilege-escalation-via-authentication-detail"},{"cve":"CVE-2026-86478","cvss":9.8,"epss":0.0061,"slug":"cve-2026-86478-jetbrains-youtrack-helpdesk-unauthenticated-account-takeover-via","title":"JetBrains YouTrack Helpdesk unauthenticated account takeover via improper email authentication","severity":"critical","exploited":false,"published_at":"2026-09-07T17:17:25.92+00:00","url":"https://junglewise.ai/threats/cve-2026-86478-jetbrains-youtrack-helpdesk-unauthenticated-account-takeover-via"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"Jetbrains YouTrack","slug":"youtrack","vulnerabilities":43,"url":"https://junglewise.ai/threats/technologies/youtrack"},{"name":"Jetbrains IntelliJ IDEA","slug":"intellij-idea","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/intellij-idea"},{"name":"Jetbrains TeamCity","slug":"teamcity","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/teamcity"},{"name":"Jetbrains GoLand","slug":"goland","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/goland"},{"name":"Jetbrains Hub","slug":"hub","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/hub"},{"name":"Jetbrains PyCharm","slug":"pycharm","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/pycharm"},{"name":"Jetbrains Webstorm","slug":"webstorm","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/webstorm"}]}