Vulnerabilidades em JetBrains

545 resultados
Análise Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2026-86487LOWIn JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas contentEPSS 0.2%CVE-2025-57727MEDIUMIn JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote referenceEPSS 0.2%CVE-2026-49381LOWIn JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleEPSS 0.2%CVE-2026-123337LOWIn JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibilityEPSS 0.2%CVE-2026-103495MEDIUMIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogsEPSS 0.2%CVE-2026-75056HIGHIn JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possibleEPSS 0.2%CVE-2026-100259MEDIUMIn JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only accessEPSS 0.2%CVE-2026-64809HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreterEPSS 0.2%CVE-2026-64808HIGHIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolingEPSS 0.2%CVE-2026-64805HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager toEPSS 0.2%CVE-2026-64806HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpretEPSS 0.2%CVE-2026-64804HIGHIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingEPSS 0.2%CVE-2026-100263MEDIUMIn JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possibleEPSS 0.2%CVE-2026-123841HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archiveEPSS 0.2%CVE-2026-123304HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathEPSS 0.2%CVE-2026-123302HIGHIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script eEPSS 0.2%CVE-2026-28194MEDIUMIn JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flowEPSS 0.2%CVE-2026-123276HIGHIn JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profileEPSS 0.2%CVE-2026-100275MEDIUMIn JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possibleEPSS 0.2%CVE-2026-123293HIGHIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path settingEPSS 0.2%