CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 严重9.8 |
In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible |
| 10/07/2026 |
| CVE-2026-59791 | 低危3.5 | In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible | 10/07/2026 |
| CVE-2026-57926 | 严重9.8 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack | 26/06/2026 |
| CVE-2026-57925 | 中危5.3 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags | 26/06/2026 |
| CVE-2026-57924 | 中危5.3 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details | 26/06/2026 |
| CVE-2026-57923 | 高危7.5 | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | 26/06/2026 |
| CVE-2026-57922 | 中危5.3 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | 26/06/2026 |
| CVE-2026-57921 | 高危7.5 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint | 26/06/2026 |
| CVE-2026-53914 | 严重9.8 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata | 26/06/2026 |
| CVE-2026-56142 | 高危8.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 privilege escalation by attaching authentication details to accounts was possible | 19/06/2026 |
| CVE-2026-56141 | 严重9.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 account takeover via predictable restore codes was possible | 19/06/2026 |
| CVE-2026-53915 | 高危8.8 | In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration | 19/06/2026 |
| CVE-2026-50242 | 严重9.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | 19/06/2026 |
| CVE-2026-49386 | 中危6.5 | In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas | 29/05/2026 |
| CVE-2026-49385 | 中危6.5 | In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts | 29/05/2026 |
| CVE-2026-49384 | 中危6.1 | In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible | 29/05/2026 |