{
  "fix": "IntelliJ IDEA (EAP) 262.5752.32",
  "url": "https://patchblox.com/security/fix/windows-app/jetbrains.intellijidea.eap-262.5752.32",
  "summary": "IntelliJ IDEA (EAP) 262.5752.32, released May 14, 2026, fixes 96 CVEs in IntelliJ IDEA (EAP). None of them is reported as exploited. Patch Radar priority: Urgent. The latest IntelliJ IDEA (EAP) is 263.7307.44, which also fixes every one of these CVEs.",
  "platform": "windows-app",
  "type": "app-version",
  "title": "IntelliJ IDEA (EAP) 262.5752.32",
  "released": "2026-05-14T00:00:00Z",
  "priority": "Urgent",
  "priorityTier": 2,
  "priorityReason": "Closes CVE-2020-11690, rated Critical",
  "supported": true,
  "cveCount": 96,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.04883,
  "maxCvss": 10,
  "appliesTo": [
    {
      "product": "IntelliJ IDEA (EAP)",
      "productUrl": "https://patchblox.com/security/product/windows-app/intellij-idea-eap",
      "fixedVersion": "262.5752.32",
      "latestVersion": "263.7307.44",
      "supported": true
    }
  ],
  "supersededBy": {
    "product": "IntelliJ IDEA (EAP)",
    "latestVersion": "263.7307.44",
    "productUrl": "https://patchblox.com/security/product/windows-app/intellij-idea-eap"
  },
  "cves": [
    {
      "cveId": "CVE-2020-11690",
      "url": "https://patchblox.com/security/cve/CVE-2020-11690",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in\u2026",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.02301,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2019-9873",
      "url": "https://patchblox.com/security/cve/CVE-2019-9873",
      "title": "IntelliJ IDEA Ultimate Edition: In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to\u2026",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.01564,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-59792",
      "url": "https://patchblox.com/security/cve/CVE-2026-59792",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace\u2026",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.00605,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-64813",
      "url": "https://patchblox.com/security/cve/CVE-2026-64813",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote\u2026",
      "priority": "Urgent",
      "cvss": 10,
      "epss": 0.00522,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-64812",
      "url": "https://patchblox.com/security/cve/CVE-2026-64812",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development\u2026",
      "priority": "Urgent",
      "cvss": 10,
      "epss": 0.00483,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-64815",
      "url": "https://patchblox.com/security/cve/CVE-2026-64815",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.00482,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2023-51655",
      "url": "https://patchblox.com/security/cve/CVE-2023-51655",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via\u2026",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.00334,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-118697",
      "url": "https://patchblox.com/security/cve/CVE-2026-118697",
      "title": "WebStorm and 11 others: Improper Certificate Validation",
      "priority": "Urgent",
      "cvss": 9,
      "epss": 0.00291,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-37051",
      "url": "https://patchblox.com/security/cve/CVE-2024-37051",
      "title": "WebStorm and 12 others: Insufficiently Protected Credentials",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.04883,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2021-30504",
      "url": "https://patchblox.com/security/cve/CVE-2021-30504",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.02307,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2017-8316",
      "url": "https://patchblox.com/security/cve/CVE-2017-8316",
      "title": "IntelliJ IDEA Ultimate Edition: IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit\u2026",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.02259,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-7914",
      "url": "https://patchblox.com/security/cve/CVE-2020-7914",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read\u2026",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.01888,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-7904",
      "url": "https://patchblox.com/security/cve/CVE-2020-7904",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.",
      "priority": "High",
      "cvss": 7.4,
      "epss": 0.01418,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-7905",
      "url": "https://patchblox.com/security/cve/CVE-2020-7905",
      "title": "IntelliJ IDEA Ultimate Edition: Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.01155,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2021-30006",
      "url": "https://patchblox.com/security/cve/CVE-2021-30006",
      "title": "IntelliJ IDEA Ultimate Edition: In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.01071,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2021-25758",
      "url": "https://patchblox.com/security/cve/CVE-2021-25758",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.01006,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-48433",
      "url": "https://patchblox.com/security/cve/CVE-2022-48433",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ\u2026",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.00646,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2021-29263",
      "url": "https://patchblox.com/security/cve/CVE-2021-29263",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00455,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-49366",
      "url": "https://patchblox.com/security/cve/CVE-2026-49366",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00455,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-24346",
      "url": "https://patchblox.com/security/cve/CVE-2022-24346",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00437,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-64814",
      "url": "https://patchblox.com/security/cve/CVE-2026-64814",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development\u2026",
      "priority": "High",
      "cvss": 8.6,
      "epss": 0.00394,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-24345",
      "url": "https://patchblox.com/security/cve/CVE-2022-24345",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.0039,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123305",
      "url": "https://patchblox.com/security/cve/CVE-2026-123305",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives\u2026",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.00336,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-49367",
      "url": "https://patchblox.com/security/cve/CVE-2026-49367",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account",
      "priority": "High",
      "cvss": 8.8,
      "epss": 0.00332,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-48430",
      "url": "https://patchblox.com/security/cve/CVE-2022-48430",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path\u2026",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.00329,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2023-39261",
      "url": "https://patchblox.com/security/cve/CVE-2023-39261",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00282,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-118696",
      "url": "https://patchblox.com/security/cve/CVE-2026-118696",
      "title": "WebStorm and 12 others: Improper Check for Certificate Revocation",
      "priority": "High",
      "cvss": 8,
      "epss": 0.00273,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123301",
      "url": "https://patchblox.com/security/cve/CVE-2026-123301",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible",
      "priority": "High",
      "cvss": 8.2,
      "epss": 0.00266,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-47896",
      "url": "https://patchblox.com/security/cve/CVE-2022-47896",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00261,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-40978",
      "url": "https://patchblox.com/security/cve/CVE-2022-40978",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Uncontrolled Search Path Element",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.0026,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-37009",
      "url": "https://patchblox.com/security/cve/CVE-2022-37009",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00254,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29814",
      "url": "https://patchblox.com/security/cve/CVE-2022-29814",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "High",
      "cvss": 7.7,
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29819",
      "url": "https://patchblox.com/security/cve/CVE-2022-29819",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "High",
      "cvss": 7.7,
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-47895",
      "url": "https://patchblox.com/security/cve/CVE-2022-47895",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2022.3.1 the \u0022Validate JSP File\u0022 action used the HTTP protocol to download\u2026",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.00224,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-57727",
      "url": "https://patchblox.com/security/cve/CVE-2025-57727",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.00214,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-86502",
      "url": "https://patchblox.com/security/cve/CVE-2026-86502",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed\u2026",
      "priority": "High",
      "cvss": 8.4,
      "epss": 0.0021,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123306",
      "url": "https://patchblox.com/security/cve/CVE-2026-123306",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the\u2026",
      "priority": "High",
      "cvss": 7.4,
      "epss": 0.00201,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123848",
      "url": "https://patchblox.com/security/cve/CVE-2026-123848",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates",
      "priority": "High",
      "cvss": 7.4,
      "epss": 0.00201,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75056",
      "url": "https://patchblox.com/security/cve/CVE-2026-75056",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00194,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123841",
      "url": "https://patchblox.com/security/cve/CVE-2026-123841",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00191,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123304",
      "url": "https://patchblox.com/security/cve/CVE-2026-123304",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.0019,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-64811",
      "url": "https://patchblox.com/security/cve/CVE-2026-64811",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00185,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-86504",
      "url": "https://patchblox.com/security/cve/CVE-2026-86504",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00185,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123838",
      "url": "https://patchblox.com/security/cve/CVE-2026-123838",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00173,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123842",
      "url": "https://patchblox.com/security/cve/CVE-2026-123842",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting\u2026",
      "priority": "High",
      "cvss": 7.1,
      "epss": 0.00169,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-48432",
      "url": "https://patchblox.com/security/cve/CVE-2022-48432",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn\u0027t sandboxed.",
      "priority": "High",
      "cvss": 8.8,
      "epss": 0.00155,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29818",
      "url": "https://patchblox.com/security/cve/CVE-2022-29818",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Origin Validation Error",
      "priority": "High",
      "cvss": 7.1,
      "epss": 0.0015,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123849",
      "url": "https://patchblox.com/security/cve/CVE-2026-123849",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform\u2026",
      "priority": "High",
      "cvss": 7,
      "epss": 0.00145,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-57729",
      "url": "https://patchblox.com/security/cve/CVE-2025-57729",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP\u2026",
      "priority": "High",
      "cvss": 7.3,
      "epss": 0.00136,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-49382",
      "url": "https://patchblox.com/security/cve/CVE-2026-49382",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00135,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-100256",
      "url": "https://patchblox.com/security/cve/CVE-2026-100256",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00133,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-48431",
      "url": "https://patchblox.com/security/cve/CVE-2022-48431",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without\u2026",
      "priority": "High",
      "cvss": 7.8,
      "epss": 0.00104,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-27622",
      "url": "https://patchblox.com/security/cve/CVE-2020-27622",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the\u2026",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.01314,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2021-25756",
      "url": "https://patchblox.com/security/cve/CVE-2021-25756",
      "title": "IntelliJ IDEA Ultimate Edition: In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead\u2026",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.01314,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2019-14954",
      "url": "https://patchblox.com/security/cve/CVE-2019-14954",
      "title": "IntelliJ IDEA Ultimate Edition: JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via\u2026",
      "priority": "Routine",
      "cvss": 5.9,
      "epss": 0.007,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-57730",
      "url": "https://patchblox.com/security/cve/CVE-2025-57730",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature",
      "priority": "Routine",
      "cvss": 4.6,
      "epss": 0.00459,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29817",
      "url": "https://patchblox.com/security/cve/CVE-2022-29817",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Cross-site Scripting (XSS)",
      "priority": "Routine",
      "cvss": 6.1,
      "epss": 0.00392,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-46970",
      "url": "https://patchblox.com/security/cve/CVE-2024-46970",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible",
      "priority": "Routine",
      "cvss": 6.1,
      "epss": 0.00392,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-86501",
      "url": "https://patchblox.com/security/cve/CVE-2026-86501",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log",
      "priority": "Routine",
      "cvss": 2.8,
      "epss": 0.0039,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2019-18361",
      "url": "https://patchblox.com/security/cve/CVE-2019-18361",
      "title": "IntelliJ IDEA Ultimate Edition: JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to\u2026",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.00375,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-28651",
      "url": "https://patchblox.com/security/cve/CVE-2022-28651",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Exposure of Sensitive System Information to an Unauthorized Control Sphere",
      "priority": "Routine",
      "cvss": 5.5,
      "epss": 0.00323,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-24941",
      "url": "https://patchblox.com/security/cve/CVE-2024-24941",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication\u2026",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.00315,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-24940",
      "url": "https://patchblox.com/security/cve/CVE-2024-24940",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives",
      "priority": "Routine",
      "cvss": 4.3,
      "epss": 0.00275,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123844",
      "url": "https://patchblox.com/security/cve/CVE-2026-123844",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.00273,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-57728",
      "url": "https://patchblox.com/security/cve/CVE-2025-57728",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover\u2026",
      "priority": "Routine",
      "cvss": 6.5,
      "epss": 0.0027,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29816",
      "url": "https://patchblox.com/security/cve/CVE-2022-29816",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
      "priority": "Routine",
      "cvss": 3.2,
      "epss": 0.0027,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123846",
      "url": "https://patchblox.com/security/cve/CVE-2026-123846",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema\u2026",
      "priority": "Routine",
      "cvss": 4.3,
      "epss": 0.00256,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123839",
      "url": "https://patchblox.com/security/cve/CVE-2026-123839",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via\u2026",
      "priority": "Routine",
      "cvss": 4.7,
      "epss": 0.00254,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-64810",
      "url": "https://patchblox.com/security/cve/CVE-2026-64810",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing\u2026",
      "priority": "Routine",
      "cvss": 6.1,
      "epss": 0.00253,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75053",
      "url": "https://patchblox.com/security/cve/CVE-2026-75053",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint",
      "priority": "Routine",
      "cvss": 5.4,
      "epss": 0.0024,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-46826",
      "url": "https://patchblox.com/security/cve/CVE-2022-46826",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read\u2026",
      "priority": "Routine",
      "cvss": 5.5,
      "epss": 0.00229,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29815",
      "url": "https://patchblox.com/security/cve/CVE-2022-29815",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "Routine",
      "cvss": 6.7,
      "epss": 0.00221,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29813",
      "url": "https://patchblox.com/security/cve/CVE-2022-29813",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "Routine",
      "cvss": 6.7,
      "epss": 0.0022,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-46827",
      "url": "https://patchblox.com/security/cve/CVE-2022-46827",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin\u2026",
      "priority": "Routine",
      "cvss": 5.5,
      "epss": 0.002,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123840",
      "url": "https://patchblox.com/security/cve/CVE-2026-123840",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs",
      "priority": "Routine",
      "cvss": 4.7,
      "epss": 0.00199,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-29812",
      "url": "https://patchblox.com/security/cve/CVE-2022-29812",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Handling of Unicode Encoding",
      "priority": "Routine",
      "cvss": 2.3,
      "epss": 0.00184,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-37010",
      "url": "https://patchblox.com/security/cve/CVE-2022-37010",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: Improper Input Validation",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00178,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75052",
      "url": "https://patchblox.com/security/cve/CVE-2026-75052",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was\u2026",
      "priority": "Routine",
      "cvss": 4.4,
      "epss": 0.00175,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2023-38069",
      "url": "https://patchblox.com/security/cve/CVE-2023-38069",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00173,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123310",
      "url": "https://patchblox.com/security/cve/CVE-2026-123310",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary\u2026",
      "priority": "Routine",
      "cvss": 5.4,
      "epss": 0.00172,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123845",
      "url": "https://patchblox.com/security/cve/CVE-2026-123845",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted\u2026",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00171,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75057",
      "url": "https://patchblox.com/security/cve/CVE-2026-75057",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log",
      "priority": "Routine",
      "cvss": 6.2,
      "epss": 0.00169,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75054",
      "url": "https://patchblox.com/security/cve/CVE-2026-75054",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted\u2026",
      "priority": "Routine",
      "cvss": 6.3,
      "epss": 0.00153,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75055",
      "url": "https://patchblox.com/security/cve/CVE-2026-75055",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE",
      "priority": "Routine",
      "cvss": 5.5,
      "epss": 0.00153,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75058",
      "url": "https://patchblox.com/security/cve/CVE-2026-75058",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers",
      "priority": "Routine",
      "cvss": 5.5,
      "epss": 0.00153,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-86505",
      "url": "https://patchblox.com/security/cve/CVE-2026-86505",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains\u2026",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00153,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123847",
      "url": "https://patchblox.com/security/cve/CVE-2026-123847",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal\u2026",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.00149,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123843",
      "url": "https://patchblox.com/security/cve/CVE-2026-123843",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00146,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-86503",
      "url": "https://patchblox.com/security/cve/CVE-2026-86503",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes\u2026",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00145,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123308",
      "url": "https://patchblox.com/security/cve/CVE-2026-123308",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted\u2026",
      "priority": "Routine",
      "cvss": 6.3,
      "epss": 0.00142,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2022-46825",
      "url": "https://patchblox.com/security/cve/CVE-2022-46825",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.0013,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123278",
      "url": "https://patchblox.com/security/cve/CVE-2026-123278",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker\u2026",
      "priority": "Routine",
      "cvss": 6.7,
      "epss": 0.00128,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123833",
      "url": "https://patchblox.com/security/cve/CVE-2026-123833",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects",
      "priority": "Routine",
      "cvss": 3.6,
      "epss": 0.00128,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-123313",
      "url": "https://patchblox.com/security/cve/CVE-2026-123313",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency\u2026",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00111,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-49383",
      "url": "https://patchblox.com/security/cve/CVE-2026-49383",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.00109,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-68269",
      "url": "https://patchblox.com/security/cve/CVE-2025-68269",
      "title": "IntelliJ IDEA Ultimate Edition and 1 other: In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects\u2026",
      "priority": "Routine",
      "cvss": 5.4,
      "epss": 0.00107,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-12T19:57:06Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}