JetBrains PyCharm
9 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118697 | < 2026.2.4 | In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 20 | CRITICAL 9.0 | 0.3 % | ||
| CVE-2026-118696 | 2026.2 – < 2026.2.4 ; 2026.1 – < 2026.1.5.1 ; < 2025.3.6.2 | In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026 | HIGH 8.0 | 0.3 % | ||
| CVE-2026-75060 | < 2026.2.1 | In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools | HIGH 8.4 | 0.2 % | ||
| CVE-2026-75059 | < 2026.2.1 | In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-65908 | < 2026.1.4, 2026.2 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open | HIGH 8.6 | 0.2 % | ||
| CVE-2026-49384 | < 2025.3.4 | In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-25847 | < 2025.3.2 | In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible | HIGH 8.2 | 0.2 % | ||
| CVE-2024-37051 | | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023 | CRITICAL 9.3 | 4.9 % | ||
| CVE-2022-29820 | 2022.1 – < 2022.1 | In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible | LOW 3.5 | 0.4 % |