| CVE-2022-46827 | MEDIO5.5 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. | 08/12/2022 |
| CVE-2022-46826 | MEDIO5.5 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. | 08/12/2022 |
| CVE-2022-46825 | BAJO3.3 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. | 08/12/2022 |
| CVE-2022-46824 | ALTO7.8 | In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. | 08/12/2022 |
| CVE-2022-40978 | ALTO7.8 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking | 19/09/2022 |
| CVE-2022-37010 | BAJO3.3 | In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed | 28/07/2022 |
| CVE-2022-37009 | ALTO7.8 | In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible | 28/07/2022 |
| CVE-2022-29819 | ALTO7.7 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible | 28/04/2022 |
| CVE-2022-29818 | ALTO7.1 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed | 28/04/2022 |
| CVE-2022-29817 | MEDIO6.1 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible | 28/04/2022 |
| CVE-2022-29816 | BAJO3.2 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible | 28/04/2022 |
| CVE-2022-29815 | MEDIO6.7 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible | 28/04/2022 |
| CVE-2022-29814 | ALTO7.7 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible | 28/04/2022 |
| CVE-2022-29813 | MEDIO6.7 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible | 28/04/2022 |
| CVE-2022-29812 | BAJO2.3 | In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient | 28/04/2022 |
| CVE-2022-28651 | MEDIO5.5 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields | 05/04/2022 |
| CVE-2022-24346 | ALTO7.8 | In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. | 25/02/2022 |
| CVE-2022-24345 | ALTO7.8 | In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible. | 25/02/2022 |
| CVE-2021-45977 | CRÍTICO9.8 | JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backen | 25/02/2022 |
| CVE-2021-30504 | ALTO7.5 | In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. | 11/05/2021 |