CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| KRITISCH9.8 |
In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible |
| 10/07/2026 |
| CVE-2026-59791 | NIEDRIG3.5 | In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible | 10/07/2026 |
| CVE-2026-57926 | KRITISCH9.8 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack | 26/06/2026 |
| CVE-2026-57925 | MITTEL5.3 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags | 26/06/2026 |
| CVE-2026-57924 | MITTEL5.3 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details | 26/06/2026 |
| CVE-2026-57923 | HOCH7.5 | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | 26/06/2026 |
| CVE-2026-57922 | MITTEL5.3 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | 26/06/2026 |
| CVE-2026-57921 | HOCH7.5 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint | 26/06/2026 |
| CVE-2026-53914 | KRITISCH9.8 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata | 26/06/2026 |
| CVE-2026-56142 | HOCH8.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 privilege escalation by attaching authentication details to accounts was possible | 19/06/2026 |
| CVE-2026-56141 | KRITISCH9.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 account takeover via predictable restore codes was possible | 19/06/2026 |
| CVE-2026-53915 | HOCH8.8 | In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration | 19/06/2026 |
| CVE-2026-50242 | KRITISCH9.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | 19/06/2026 |
| CVE-2026-49386 | MITTEL6.5 | In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas | 29/05/2026 |
| CVE-2026-49385 | MITTEL6.5 | In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts | 29/05/2026 |
| CVE-2026-49384 | MITTEL6.1 | In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible | 29/05/2026 |