Vulnerabilidades em JetBrains

545 resultados
Análise Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2026-86485LOWIn JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooksEPSS 0.2%CVE-2026-49380LOWIn JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possibleEPSS 0.2%CVE-2022-48432MEDIUMIn JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.EPSS 0.2%CVE-2025-43013MEDIUMIn JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possibleEPSS 0.2%CVE-2026-75055MEDIUMIn JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXEEPSS 0.2%CVE-2026-75054MEDIUMIn JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projectsEPSS 0.2%CVE-2026-86505LOWIn JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains MarketplaceEPSS 0.2%CVE-2026-75058MEDIUMIn JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importersEPSS 0.2%CVE-2026-103497MEDIUMIn JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationEPSS 0.2%CVE-2024-43114HIGHIn JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissionsEPSS 0.2%CVE-2022-29818LOWIn JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawedEPSS 0.1%CVE-2026-28196LOWIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on diskEPSS 0.1%CVE-2026-123847MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completionEPSS 0.1%CVE-2025-54529LOWIn JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integrationEPSS 0.1%CVE-2026-123858MEDIUMIn JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projectsEPSS 0.1%CVE-2026-123843LOWIn JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configurationEPSS 0.1%CVE-2026-123318MEDIUMIn JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engineEPSS 0.1%CVE-2026-86503LOWIn JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetchingEPSS 0.1%CVE-2026-123849HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File WatchersEPSS 0.1%CVE-2026-123320LOWIn JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious serverEPSS 0.1%