Skip to content
Noroxi

JetBrains records

661 published records for vendor jetbrains.

Researcher profile

Entered KEV
4 · 0.6%
Weaponized
4 · 0.6%
Pre-auth RCE
27
With a fix record
61%
Median publish → KEV
12 days

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

661 records
  • CVE-2023-42793
    99Now

    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jetbrains · teamcitySep 19, 2023

  • CVE-2024-27198
    99Now

    In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jetbrains · teamcityMar 4, 2024

  • CVE-2026-63077
    97Now

    In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    jetbrains · teamcityJul 27, 2026

  • CVE-2024-27199
    89Now

    In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

    HighCVSS 7.3KEVWeaponizedEPSS 99%

    jetbrains · teamcityMar 4, 2024

  • CVE-2024-23917
    55Plan

    In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

    CriticalCVSS 9.8Proof of conceptEPSS 54%

    jetbrains · teamcityFeb 6, 2024

  • CVE-2026-49373
    45Plan

    In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

    HighCVSS 8.8No exploitEPSS 32%

    jetbrains · teamcityMay 29, 2026

  • CVE-2024-31138
    43Plan

    In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

    MediumCVSS 5.4No exploitEPSS 74%

    jetbrains · teamcityMar 28, 2024

  • CVE-2025-46618
    43Plan

    In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab

    MediumCVSS 6.1No exploitEPSS 63%

    jetbrains · teamcityApr 25, 2025

  • CVE-2019-15039
    43Plan

    An issue was discovered in JetBrains TeamCity 2018.2.4.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    jetbrains · teamcityOct 1, 2019

  • CVE-2022-48343
    42Plan

    In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.

    MediumCVSS 6.1No exploitEPSS 59%

    jetbrains · teamcityFeb 23, 2023

  • CVE-2022-48428
    41Plan

    In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

    MediumCVSS 5.4No exploitEPSS 67%

    jetbrains · teamcityMar 27, 2023

  • CVE-2023-41249
    41Plan

    In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step

    MediumCVSS 6.1No exploitEPSS 55%

    jetbrains · teamcityAug 25, 2023

  • CVE-2024-47949
    40Plan

    In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

    HighCVSS 7.5No exploitEPSS 32%

    jetbrains · teamcityOct 8, 2024

  • CVE-2020-25207
    40Plan

    JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.

    CriticalCVSS 9.8No exploitEPSS 4%

    jetbrains · toolboxNov 16, 2020

  • CVE-2019-9186
    40Plan

    In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute co

    CriticalCVSS 9.8No exploitEPSS 4%

    jetbrains · intellij ideaJul 3, 2019

  • CVE-2019-10104
    40Plan

    In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with

    CriticalCVSS 9.8No exploitEPSS 3%

    jetbrains · intellij ideaJul 3, 2019

  • CVE-2022-24442
    40Plan

    JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    jetbrains · youtrackFeb 25, 2022

  • CVE-2021-25770
    40Plan

    In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.

    CriticalCVSS 9.8No exploitEPSS 3%

    jetbrains · youtrackFeb 3, 2021

  • CVE-2019-18364
    40Plan

    In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.

    CriticalCVSS 9.8No exploitEPSS 3%

    jetbrains · teamcityOct 31, 2019

  • CVE-2021-31909
    40Plan

    In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.

    CriticalCVSS 9.8No exploitEPSS 3%

    jetbrains · teamcityMay 11, 2021

  • CVE-2021-31915
    40Plan

    In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.

    CriticalCVSS 9.8No exploitEPSS 3%

    jetbrains · teamcityMay 11, 2021

  • CVE-2020-11690
    40Plan

    In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.

    CriticalCVSS 9.8No exploitEPSS 2%

    jetbrains · intellij ideaApr 22, 2020

  • CVE-2021-31914
    40Plan

    In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.

    CriticalCVSS 9.8No exploitEPSS 2%

    jetbrains · teamcityMay 11, 2021

  • CVE-2019-10100
    40Plan

    In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection.

    CriticalCVSS 9.8No exploitEPSS 2%

    jetbrains · youtrack integrationJul 3, 2019

  • CVE-2019-12736
    40Plan

    JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injec

    CriticalCVSS 9.8No exploitEPSS 2%

    jetbrains · ktorOct 2, 2019