Known vulnerabilities in IntelliJ IDEA 2026.1.5

Software: IntelliJ IDEA
Version: 2026.1.5
Software CPE: cpe:2.3:a:jetbrains_s.r.o.:intellij_idea:*:*:*:*:*:*:*:*
Total vulnerabilities: 18
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting IntelliJ IDEA version 2026.1.5 IntelliJ IDEA 2026.1.5 is affected by 18 vulnerabilities: 4 high, 7 medium, 7 low Critical High Medium Low

Vulnerabilities (18)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU147336 - Information Exposure Through Log Files
CVE-2026-86501
CWE-532 Low
No
No
2026.2.2 07.09.2026 SB20260907137
#VU147335 - Missing Authentication for Critical Function
CVE-2026-86502
CWE-306 High
No
No
2026.2.2 07.09.2026 SB20260907137
#VU147334 - Server-Side Request Forgery (SSRF)
CVE-2026-86503
CWE-918 Low
No
No
2026.2.2 07.09.2026 SB20260907137
#VU147333 - Inclusion of Functionality from Untrusted Control Sphere
CVE-2026-86504
CWE-829 High
No
No
2026.2.2 07.09.2026 SB20260907137
#VU147332 - Insertion of Sensitive Information Into Sent Data
CVE-2026-86505
CWE-201 Low
No
No
2026.2.2 07.09.2026 SB20260907137
#VU143869 - Command injection
CVE-2026-75052
CWE-77 Medium
No
No
2026.2.1 17.08.2026 SB20260817105
#VU143868 - Server-Side Request Forgery (SSRF)
CVE-2026-75053
CWE-918 Medium
No
No
2026.2.1 17.08.2026 SB20260817105
#VU143867 - Server-Side Request Forgery (SSRF)
CVE-2026-75054
CWE-918 Low
No
No
2026.2.1 17.08.2026 SB20260817105
#VU143866 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2026-75055
CWE-611 Medium
No
No
2026.2.1 17.08.2026 SB20260817105
#VU143865 - Command injection
CVE-2026-75056
CWE-77 Medium
No
No
2026.2.1 17.08.2026 SB20260817105
#VU143863 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2026-75058
CWE-611 Low
No
No
2026.2.1 17.08.2026 SB20260817105
#VU143856 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-64815
CWE-94 Medium
No
No
2026.2 17.08.2026 SB2026081799
#VU143855 - Missing Authorization
CVE-2026-64814
CWE-862 Low
No
No
2026.2 17.08.2026 SB2026081799
#VU143854 - Client-Side Enforcement of Server-Side Security
CVE-2026-64813
CWE-602 Low
No
No
2026.2 17.08.2026 SB2026081799
#VU143853 - Missing Authentication for Critical Function
CVE-2026-64812
CWE-306 Medium
No
No
2026.2 17.08.2026 SB2026081799
#VU143852 - Inclusion of Functionality from Untrusted Control Sphere
CVE-2026-64811
CWE-829 High
No
No
2026.2 17.08.2026 SB2026081799
#VU143851 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-64810
CWE-79 Medium
No
No
2026.2 17.08.2026 SB2026081799
#VU143846 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-59792
CWE-22 High
No
No
2026.1.4, 2026.2 17.08.2026 SB2026081799