Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-63077KEVexploit ×8 | 9.8 critical | 94.0% | jetbrains, teamcity | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | Sat 24 Oct |
| CVE-2026-64813 | 10.0 critical | 1.0% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session | Sat 24 Oct |
| CVE-2026-65906 | 10.0 critical | 1.0% | jetbrains, teamcity | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | Sat 24 Oct |
| CVE-2026-50242 | 9.8 critical | 1.0% | jetbrains, hub | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | Mon 26 Oct |
| CVE-2026-56141 | 9.8 critical | 1.0% | jetbrains, hub | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible | Mon 26 Oct |
| CVE-2026-59792 | 9.8 critical | 1.0% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible | Sat 24 Oct |
| CVE-2026-62422 | 9.8 critical | 1.0% | jetbrains, youtrack | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | Sat 24 Oct |
| CVE-2026-65907 | 9.1 critical | 1.0% | no CPE yet | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible | Sat 24 Oct |
| CVE-2026-56142 | 8.8 high | 1.0% | jetbrains, hub | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible | Mon 26 Oct |
| CVE-2026-106219 | 7.5 high | 1.0% | jetbrains, teamcity | In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server | 8 Oct |
| CVE-2026-75050 | 6.5 medium | 1.0% | jetbrains, youtrack | In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters | Fri 23 Oct |
| CVE-2026-61492 | 6.1 medium | 1.0% | jetbrains, youtrack | In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible | Sun 25 Oct |
| CVE-2026-64800 | 5.7 medium | 1.0% | jetbrains, goland | In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default | Sat 24 Oct |
| CVE-2026-64812 | 10.0 critical | 0.00% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session | Sat 24 Oct |
| CVE-2026-106218 | 10.0 critical | 0.00% | jetbrains, teamcity | In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible | 8 Oct |
| CVE-2026-41153 | 9.8 critical | 0.00% | jetbrains, junie | In JetBrains Junie before 252.549.29 command execution was possible via malicious project file | Mon 26 Oct |
| CVE-2026-53914 | 9.8 critical | 0.00% | jetbrains, kotlin | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata | Sun 25 Oct |
| CVE-2026-57926 | 9.8 critical | 0.00% | jetbrains, youtrack | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack | Sun 25 Oct |
| CVE-2026-64815 | 9.8 critical | 0.00% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | Sat 24 Oct |
| CVE-2026-111094 | 9.8 critical | 0.00% | jetbrains, teamcity | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible | 16 Oct |
| CVE-2026-108474 | 9.8 critical | 0.00% | no CPE yet | In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions | 14 Oct |
| CVE-2026-53915 | 8.8 high | 0.00% | jetbrains, goland | In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration | Mon 26 Oct |
| CVE-2026-59793 | 8.8 high | 0.00% | jetbrains, teamcity | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration | Sat 24 Oct |
| CVE-2026-64814 | 8.6 high | 0.00% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | Sat 24 Oct |
| CVE-2026-65908 | 8.6 high | 0.00% | jetbrains, pycharm | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open | Sat 24 Oct |
| CVE-2026-64804 | 8.4 high | 0.00% | jetbrains, webstorm | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling | Sat 24 Oct |
| CVE-2026-64805 | 8.4 high | 0.00% | jetbrains, webstorm | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling | Sat 24 Oct |
| CVE-2026-64806 | 8.4 high | 0.00% | jetbrains, webstorm | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter | Sat 24 Oct |
| CVE-2026-64808 | 8.4 high | 0.00% | jetbrains, phpstorm | In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling | Sat 24 Oct |
| CVE-2026-64809 | 8.4 high | 0.00% | jetbrains, phpstorm | In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter | Sat 24 Oct |
| CVE-2026-75060 | 8.4 high | 0.00% | jetbrains, pycharm | In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools | Fri 23 Oct |
| CVE-2026-75048 | 8.2 high | 0.00% | jetbrains, youtrack | In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible | Fri 23 Oct |
| CVE-2026-59796 | 8.1 high | 0.00% | jetbrains, teamcity | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks | Sat 24 Oct |
| CVE-2026-75051 | 8.1 high | 0.00% | jetbrains, youtrack | In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible | Fri 23 Oct |
| CVE-2026-64802 | 7.8 high | 0.00% | jetbrains, goland | In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration | Sat 24 Oct |
| CVE-2026-64803 | 7.8 high | 0.00% | jetbrains, goland | In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK | Sat 24 Oct |
| CVE-2026-64807 | 7.8 high | 0.00% | jetbrains, webstorm | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration | Sat 24 Oct |
| CVE-2026-64811 | 7.8 high | 0.00% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration | Sat 24 Oct |
| CVE-2026-75056 | 7.8 high | 0.00% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible | Fri 23 Oct |
| CVE-2026-111091 | 7.8 high | 0.00% | no CPE yet | In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration | 15 Oct |
| CVE-2026-41882 | 7.5 high | 0.00% | jetbrains, intellij_idea | In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server | Mon 26 Oct |
| CVE-2026-44413 | 7.5 high | 0.00% | jetbrains, teamcity | In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access | Mon 26 Oct |
| CVE-2026-57921 | 7.5 high | 0.00% | jetbrains, youtrack | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint | Sun 25 Oct |
| CVE-2026-57923 | 7.5 high | 0.00% | jetbrains, youtrack | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | Sun 25 Oct |
| CVE-2026-111093 | 7.5 high | 0.00% | no CPE yet | In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files | 15 Oct |
| CVE-2026-33392 | 7.2 high | 0.00% | jetbrains, youtrack | In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass | Mon 26 Oct |
| CVE-2026-117530 | 6.7 medium | 0.00% | no CPE yet | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands | Tue 27 Oct |
| CVE-2026-75049 | 6.5 medium | 0.00% | jetbrains, youtrack | In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint | Fri 23 Oct |
| CVE-2026-111092 | 6.5 medium | 0.00% | no CPE yet | In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands | 16 Oct |
| CVE-2026-77157 | 6.3 medium | 0.00% | no CPE yet | ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download. Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download. The download is now verified against a published SHA-256 checksum before extraction. | Fri 23 Oct |
50 of 67 · Next
Download these 67 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.