# JetBrains IntelliJ IDEA.

Every CVE that names JetBrains IntelliJ IDEA among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Improper certificate validation in JetBrains Toolbox App and others](https://agentprime.io/advisories/CVE-2026-118697.md)
  `CVE-2026-118697` · CVE record: JetBrains Toolbox App and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3…](https://agentprime.io/advisories/CVE-2026-118696.md)
  `CVE-2026-118696` · CVE record: JetBrains IntelliJ IDEA and 4 more · CVSS 8.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-299
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints…](https://agentprime.io/advisories/CVE-2026-100256.md)
  `CVE-2026-100256` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-829
- [Information disclosure in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-86505.md)
  `CVE-2026-86505` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before…](https://agentprime.io/advisories/CVE-2026-86504.md)
  `CVE-2026-86504` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.8 High · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-829
- [Server-side request forgery in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-86503.md)
  `CVE-2026-86503` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Missing authentication in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-86502.md)
  `CVE-2026-86502` · CVE record: JetBrains IntelliJ IDEA · CVSS 8.4 High · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Sensitive information in log files in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-86501.md)
  `CVE-2026-86501` · CVE record: JetBrains IntelliJ IDEA · CVSS 2.8 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure
- [XML external entity injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75058.md)
  `CVE-2026-75058` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: XML external entities (XXE)
- [Sensitive information in log files in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75057.md)
  `CVE-2026-75057` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.2 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Information disclosure
- [OS command injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75056.md)
  `CVE-2026-75056` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection
- [XML external entity injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75055.md)
  `CVE-2026-75055` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: XML external entities (XXE)
- [Server-side request forgery in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75054.md)
  `CVE-2026-75054` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75053.md)
  `CVE-2026-75053` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.4 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Command injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-75052.md)
  `CVE-2026-75052` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.6 Low · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection
- [Code injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-64815.md)
  `CVE-2026-64815` · CVE record: JetBrains IntelliJ IDEA · CVSS 8.1 High · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection
- [Missing authorization in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-64814.md)
  `CVE-2026-64814` · CVE record: JetBrains IntelliJ IDEA · CVSS 8.6 High · Not analysed yet · Published 23 Jul 2026 · Tags: Broken access control
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible…](https://agentprime.io/advisories/CVE-2026-64813.md)
  `CVE-2026-64813` · CVE record: JetBrains IntelliJ IDEA · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-602
- [Missing authentication in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-64812.md)
  `CVE-2026-64812` · CVE record: JetBrains IntelliJ IDEA · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Authentication bypass
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before…](https://agentprime.io/advisories/CVE-2026-64811.md)
  `CVE-2026-64811` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-829
- [Cross-site scripting in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-64810.md)
  `CVE-2026-64810` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Path traversal in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-59792.md)
  `CVE-2026-59792` · CVE record: JetBrains IntelliJ IDEA · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2026 · Tags: Path traversal
- [XML external entity injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-49383.md)
  `CVE-2026-49383` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 29 May 2026 · Tags: XML external entities (XXE)
- [Template injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-49382.md)
  `CVE-2026-49382` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.5 Medium · Not analysed yet · Published 29 May 2026 · Tags: Code injection
- [Missing authorization in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-49367.md)
  `CVE-2026-49367` · CVE record: JetBrains IntelliJ IDEA · CVSS 8.0 High · Not analysed yet · Published 29 May 2026 · Tags: Broken access control
- [OS command injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-49366.md)
  `CVE-2026-49366` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.8 High · Not analysed yet · Published 29 May 2026 · Tags: Command injection
- [Symlink following in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-41882.md)
  `CVE-2026-41882` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.4 High · Not analysed yet · Published 30 Apr 2026 · Tags: Path traversal
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of…](https://agentprime.io/advisories/CVE-2025-68269.md)
  `CVE-2025-68269` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.4 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-349
- [Cross-site scripting in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2025-57730.md)
  `CVE-2025-57730` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.2 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS)
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to…](https://agentprime.io/advisories/CVE-2025-57729.md)
  `CVE-2025-57729` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-829
- [Incorrect authorization in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2025-57728.md)
  `CVE-2025-57728` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Broken access control
- [Cleartext transmission of sensitive information in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2025-57727.md)
  `CVE-2025-57727` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.7 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Weak cryptography or TLS
- [Sensitive information in log files in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2025-32054.md)
  `CVE-2025-32054` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 3 Apr 2025 · Tags: Information disclosure
- [Cross-site scripting in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2024-46970.md)
  `CVE-2024-46970` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 16 Sept 2024 · Tags: Cross-site scripting (XSS)
- [Insufficiently protected credentials in JetBrains IntelliJ IDEA and others](https://agentprime.io/advisories/CVE-2024-37051.md)
  `CVE-2024-37051` · CVE record: JetBrains IntelliJ IDEA and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2024 · Tags: Hard-coded credentials
- [Improper input validation in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2024-24941.md)
  `CVE-2024-24941` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.1 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-20
- [Path traversal in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2024-24940.md)
  `CVE-2024-24940` · CVE record: JetBrains IntelliJ IDEA · CVSS 2.8 Low · Not analysed yet · Published 6 Feb 2024 · Tags: Path traversal
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted…](https://agentprime.io/advisories/CVE-2023-51655.md)
  `CVE-2023-51655` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.3 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: CWE-349
- [Execution with unnecessary privileges in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2023-39261.md)
  `CVE-2023-39261` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.2 Medium · Not analysed yet · Published 26 Jul 2023 · Tags: Privilege escalation
- [Improper check for unusual conditions in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2023-38069.md)
  `CVE-2023-38069` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 12 Jul 2023 · Tags: CWE-754
- [Insufficiently protected credentials in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-48433.md)
  `CVE-2022-48433` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.1 Medium · Not analysed yet · Published 29 Mar 2023 · Tags: Hard-coded credentials
- [In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.](https://agentprime.io/advisories/CVE-2022-48432.md)
  `CVE-2022-48432` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.2 Medium · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-1188
- [Insufficient verification of data authenticity in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-48431.md)
  `CVE-2022-48431` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.5 Medium · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-345
- [Information disclosure in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-48430.md)
  `CVE-2022-48430` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.5 Medium · Not analysed yet · Published 29 Mar 2023 · Tags: Information disclosure
- [Template injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-47896.md)
  `CVE-2022-47896` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.0 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Code injection
- [Cleartext transmission of sensitive information in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-47895.md)
  `CVE-2022-47895` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.7 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Weak cryptography or TLS
- [In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.](https://agentprime.io/advisories/CVE-2022-46828.md)
  `CVE-2022-46828` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.2 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: CWE-691
- [XML external entity injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-46827.md)
  `CVE-2022-46827` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.9 Low · Not analysed yet · Published 8 Dec 2022 · Tags: XML external entities (XXE)
- [Path traversal in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-46826.md)
  `CVE-2022-46826` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.2 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: Path traversal
- [Information disclosure in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-46825.md)
  `CVE-2022-46825` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.0 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: Information disclosure
- [Buffer overflow in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-46824.md)
  `CVE-2022-46824` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.6 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: Memory corruption
- [Uncontrolled search path in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-40978.md)
  `CVE-2022-40978` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.5 High · Not analysed yet · Published 19 Sept 2022 · Tags: CWE-427
- [Improper input validation in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-37010.md)
  `CVE-2022-37010` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.6 Low · Not analysed yet · Published 28 Jul 2022 · Tags: CWE-20
- [Code injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-37009.md)
  `CVE-2022-37009` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.9 Low · Not analysed yet · Published 28 Jul 2022 · Tags: Code injection
- [Code injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-29819.md)
  `CVE-2022-29819` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2022 · Tags: Code injection
- [Origin validation error in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-29818.md)
  `CVE-2022-29818` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.9 Low · Not analysed yet · Published 28 Apr 2022 · Tags: CWE-346
- [Cross-site scripting in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-29817.md)
  `CVE-2022-29817` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.9 Low · Not analysed yet · Published 28 Apr 2022 · Tags: Cross-site scripting (XSS)
- [Injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-29816.md)
  `CVE-2022-29816` · CVE record: JetBrains IntelliJ IDEA · CVSS 2.8 Low · Not analysed yet · Published 28 Apr 2022 · Tags: Other injection
- [Code injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-29815.md)
  `CVE-2022-29815` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2022 · Tags: Code injection
- [Code injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-29814.md)
  `CVE-2022-29814` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2022 · Tags: Code injection

Older: <https://agentprime.io/advisories/technology/jetbrains-intellij-idea.md?cursor=WyIyMDIyLTA0LTI4VDA5OjU1OjIxLjAwMDAwMFoiLCJDVkUtMjAyMi0yOTgxNCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=jetbrains-intellij-idea>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/jetbrains-intellij-idea/>. Everything for agents: <https://agentprime.io/llms.txt>.