Intellij Idea
by Jetbrains
CVEs (82)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-75058 | Med | 0.36 | 5.5 | 0.00 | Aug 17, 2026 | In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers | ||
| CVE-2026-75055 | Med | 0.36 | 5.5 | 0.00 | Aug 17, 2026 | In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE | ||
| CVE-2022-48430 | Med | 0.36 | 5.5 | 0.00 | Mar 29, 2023 | In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. | ||
| CVE-2022-46824 | Med | 0.36 | 5.6 | 0.00 | Dec 8, 2022 | In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. | ||
| CVE-2026-75053 | Med | 0.35 | 5.4 | 0.00 | Aug 17, 2026 | In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint | ||
| CVE-2025-68269 | Med | 0.35 | 5.4 | 0.00 | Dec 16, 2025 | In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH | ||
| CVE-2021-25756 | Med | 0.35 | 5.3 | 0.01 | Feb 3, 2021 | In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS. | ||
| CVE-2020-27622 | Med | 0.35 | 5.3 | 0.01 | Nov 16, 2020 | In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version. | ||
| CVE-2025-57730 | Med | 0.34 | 5.2 | 0.00 | Aug 20, 2025 | In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature | ||
| CVE-2023-39261 | Med | 0.34 | 5.2 | 0.00 | Jul 26, 2023 | In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions | ||
| CVE-2022-48432 | Med | 0.34 | 5.2 | 0.00 | Mar 29, 2023 | In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. | ||
| CVE-2022-46828 | Med | 0.34 | 5.2 | 0.00 | Dec 8, 2022 | In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. | ||
| CVE-2019-18361 | Med | 0.34 | 5.3 | 0.00 | Oct 31, 2019 | JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution. | ||
| CVE-2022-47896 | Med | 0.33 | 5.0 | 0.00 | Dec 22, 2022 | In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. | ||
| CVE-2025-57727 | Med | 0.31 | 4.7 | 0.00 | Aug 20, 2025 | In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference | ||
| CVE-2022-47895 | Med | 0.31 | 4.7 | 0.00 | Dec 22, 2022 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. | ||
| CVE-2026-49382 | Med | 0.29 | 4.5 | 0.00 | May 29, 2026 | In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin | ||
| CVE-2022-48431 | Med | 0.29 | 4.5 | 0.00 | Mar 29, 2023 | In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. | ||
| CVE-2022-46825 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2022 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. | ||
| CVE-2022-46827 | Low | 0.25 | 3.9 | 0.00 | Dec 8, 2022 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
- risk 0.36cvss 5.5epss 0.00
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
- risk 0.36cvss 5.5epss 0.00
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
- risk 0.36cvss 5.5epss 0.00
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.
- risk 0.36cvss 5.6epss 0.00
In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.
- risk 0.35cvss 5.4epss 0.00
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
- risk 0.35cvss 5.4epss 0.00
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
- risk 0.35cvss 5.3epss 0.01
In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.
- risk 0.35cvss 5.3epss 0.01
In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.
- risk 0.34cvss 5.2epss 0.00
In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature
- risk 0.34cvss 5.2epss 0.00
In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions
- risk 0.34cvss 5.2epss 0.00
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
- risk 0.34cvss 5.2epss 0.00
In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
- risk 0.34cvss 5.3epss 0.00
JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.
- risk 0.33cvss 5.0epss 0.00
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
- risk 0.31cvss 4.7epss 0.00
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
- risk 0.31cvss 4.7epss 0.00
In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.
- risk 0.29cvss 4.5epss 0.00
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
- risk 0.29cvss 4.5epss 0.00
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.
- risk 0.26cvss 4.0epss 0.00
In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.
- risk 0.25cvss 3.9epss 0.00
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.
Page 3 of 5