Threat database

CVE-2026-65908 is a high-severity vulnerability in JetBrains PyCharm that allows arbitrary code execution via a malicious Python executable when opening an untrusted project. This affects versions before 2026.1.4 and certain 2026.2 versions. The vulnerability is related to CWE-829, which involves inclusion of functionality from untrusted control spheres. The CVSS score is 8.6, indicating a significant risk. No official patch or remediation guidance is currently provided by the vendor. Exploits in the wild are not known at this time.

A high-severity vulnerability (CWE-94) in JetBrains TeamCity before versions 2026.1.2 and 2025.11.6 allows code execution via escape from the Kotlin DSL sandbox. This vulnerability enables an attacker with limited privileges to execute arbitrary code without user interaction. No official patch or remediation guidance has been confirmed yet.

A high-severity vulnerability (CVE-2026-64815) exists in JetBrains IntelliJ IDEA before version 2026.2 that allows arbitrary code injection via UI Designer form files. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code). It has a CVSS 3.1 score of 8.1, indicating a high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided by the vendor. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

A critical vulnerability (CWE-602) exists in JetBrains IntelliJ IDEA versions prior to 2026.2 that allows unauthorized modification of settings during a Remote Development session. This flaw can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 10.0, indicating it is exploitable remotely without privileges or user interaction. No official patch or remediation guidance has been provided yet by the vendor.

CVE-2026-64812 is a critical vulnerability in JetBrains IntelliJ IDEA that allows unauthorized input injection during a Remote Development session in versions before 2026.2. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance has been provided yet.

A high-severity vulnerability (CWE-829) exists in JetBrains IntelliJ IDEA before version 2026.2 that allows arbitrary code execution prior to granting project trust when using development container configuration. This vulnerability requires local access and user interaction but can lead to full confidentiality, integrity, and availability compromise. No official patch or remediation guidance has been confirmed yet.

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

A high-severity vulnerability (CWE-829) in JetBrains PhpStorm before version 2026.2 allows arbitrary code execution prior to granting project trust via the configured interpreter. This means that an attacker could execute code without user authorization in affected versions. The vulnerability has a CVSS score of 8.4, indicating significant impact on confidentiality, integrity, and availability.

A high-severity vulnerability (CWE-829) exists in JetBrains PhpStorm before version 2026.2 that allows arbitrary code execution before the user grants project trust via project tooling. This vulnerability enables an attacker to execute code without user interaction or privileges. No patch or official remediation information is currently provided by the vendor.

A vulnerability (CWE-829) in JetBrains WebStorm before version 2026.2 allows arbitrary code execution via a project-supplied linter configuration. This issue has a high severity with a CVSS score of 7.8. The vulnerability requires local access with user interaction and can lead to full confidentiality, integrity, and availability compromise. No official patch or remediation guidance has been confirmed yet.

A high-severity vulnerability (CWE-829) in JetBrains WebStorm before version 2026.2 allows arbitrary code execution via the configured Node.js interpreter before project trust is granted. This issue affects local attack vectors without user interaction and impacts confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.

CVE-2026-64805 is a high-severity vulnerability in JetBrains WebStorm before version 2026.2 that allows arbitrary code execution via project-local package-manager tooling before the user grants project trust. This vulnerability is classified under CWE-829, which involves inclusion of functionality from untrusted control spheres. The CVSS 3.1 base score is 8.4, indicating a high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

JetBrains WebStorm versions before 2026.2 contain a vulnerability (CWE-829) that allows arbitrary code execution before a project is granted trust via project-local linter tooling. This vulnerability has a high severity with a CVSS score of 8.4. No specific affected versions or patches are currently provided by the vendor.

A high-severity vulnerability (CWE-94) in JetBrains GoLand before version 2026.2 allows arbitrary code execution via the configured Go SDK before project trust is granted. This issue affects local users and requires user interaction. The vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability.

A high-severity vulnerability (CWE-94) in JetBrains GoLand before version 2026.2 allows arbitrary code execution prior to granting project trust in the Go Modules integration. This issue could enable an attacker to execute code with the privileges of the user running the IDE. The vulnerability has a CVSS 3.1 score of 7.8, indicating a significant risk. No official patch or remediation level has been explicitly stated in the provided data. There are no known exploits in the wild at this time.

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks