Toolbox
Vendor:
First CVE: Oct 2, 2019 · Active for 6 years
11
Total CVEs
More Total CVEs than 89% of tracked products
2.2
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Toolbox over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 2, 2019
6 years ago
Most Recent CVE
Apr 17, 2025
465 days ago
CVE Severity & Scoring
Toolbox11 CVEs
36%
45%
18%
All CVEs352,719 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local2 (18.2%)
Network9 (81.8%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (90.9%)
High1 (9.1%)
Unknown0 (0.0%)
User Interaction
None10 (90.9%)
Unknown0 (0.0%)
Required1 (9.1%)
Privileges Required
Low1 (9.1%)
High0 (0.0%)
None10 (90.9%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-25207CRITICAL JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. | Nov 16, 2020 | 9.8 | 31 | NO | NO |
CVE-2025-43012CRITICAL In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible | Apr 17, 2025 | 9.8 | 30 | NO | NO |
CVE-2022-48481HIGH In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible | Apr 28, 2023 | 7.8 | 24 | NO | NO |
CVE-2020-15827HIGH In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file. | Aug 8, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-18368HIGH In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible. | Oct 31, 2019 | 7.3 | 24 | NO | NO |
CVE-2025-43013HIGH In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible | Apr 17, 2025 | 7.5 | 21 | NO | NO |
CVE-2020-25013HIGH JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. | Nov 16, 2020 | 7.5 | 21 | NO | NO |
CVE-2019-14959MEDIUM JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. | Oct 2, 2019 | 5.9 | 19 | NO | NO |
CVE-2025-43014MEDIUM In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation | Apr 17, 2025 | 6.5 | 18 | NO | NO |
CVE-2025-42921MEDIUM In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin | Apr 17, 2025 | 6.5 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Toolbox
Top CWEs
Versions
No cataloged versions.