Vulnerabilidades en JetBrains

406 resultados
Análisis Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2026-75046MEDIUMIn JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpointEPSS 0.2%CVE-2025-68268MEDIUMIn JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageEPSS 0.2%CVE-2026-49369MEDIUMIn JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pagesEPSS 0.2%CVE-2025-64683MEDIUMIn JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users APIEPSS 0.2%CVE-2026-86479HIGHIn JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resourcEPSS 0.2%CVE-2026-86488MEDIUMIn JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searchesEPSS 0.2%CVE-2026-86489MEDIUMIn JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizationsEPSS 0.2%CVE-2022-46827LOWIn JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.EPSS 0.2%CVE-2026-75048HIGHIn JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possibleEPSS 0.2%CVE-2022-37396MEDIUMIn JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code executionEPSS 0.2%CVE-2025-68166MEDIUMIn JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tabEPSS 0.2%CVE-2025-42921MEDIUMIn JetBrains Toolbox App before 2.6 host key verification was missing in SSH pluginEPSS 0.2%CVE-2026-86481MEDIUMIn JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project iconsEPSS 0.2%CVE-2025-57727MEDIUMIn JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote referenceEPSS 0.2%CVE-2026-64806HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpretEPSS 0.2%CVE-2026-64809HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreterEPSS 0.2%CVE-2026-64808HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolingEPSS 0.2%CVE-2026-86495MEDIUMIn JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projectsEPSS 0.2%CVE-2026-64804HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingEPSS 0.2%CVE-2026-86490MEDIUMIn JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpointEPSS 0.2%