Vulnerabilidades em JetBrains

545 resultados
Análise Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2026-100253HIGHIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings EPSS 0.4%CVE-2024-38505MEDIUMIn JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteEPSS 0.4%CVE-2025-32054LOWIn JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log fileEPSS 0.4%CVE-2025-57730MEDIUMIn JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development featureEPSS 0.4%CVE-2024-31134MEDIUMIn JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registratioEPSS 0.4%CVE-2022-44646LOWIn JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settingsEPSS 0.4%CVE-2026-33392HIGHIn JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypassEPSS 0.4%CVE-2024-31140MEDIUMIn JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing toolsEPSS 0.4%CVE-2025-48391HIGHIn JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in APIEPSS 0.4%CVE-2026-75044HIGHIn JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitEPSS 0.4%CVE-2025-59455MEDIUMIn JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionEPSS 0.4%CVE-2024-54155LOWIn JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authenticationEPSS 0.4%CVE-2025-26492HIGHIn JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resourcesEPSS 0.4%CVE-2026-86482HIGHIn JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalationEPSS 0.4%CVE-2024-24943MEDIUMIn JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG imageEPSS 0.4%CVE-2024-22370MEDIUMIn JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleEPSS 0.4%CVE-2024-41827HIGHIn JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expirationEPSS 0.4%CVE-2026-41882HIGHIn JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible viEPSS 0.4%CVE-2023-34228MEDIUMIn JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actionsEPSS 0.4%CVE-2023-39173MEDIUMIn JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account accessEPSS 0.4%