Jetbrains vulnerabilities
Published CVEs affecting Jetbrains products: 159 record(s), with severity, exploitation and fixes.
Youtrack 61Teamcity 44Intellij Idea 21Hub 9Pycharm 5Webstorm 4Goland 4Phpstorm 2Rider 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1
CVE-2026-111096
Medium · 6.7
CWE-79 Oct 15, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible
CVE-2026-111095
High · 8.0
CWE-79 Oct 15, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possible
CVE-2026-111094
High · 8.1
CWE-502 Oct 15, 2026
Deserialization of Untrusted Data in Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVE-2026-111093
High · 7.5
CWE-23 Oct 15, 2026
Relative Path Traversal in Jetbrains Datalore
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
CVE-2026-111092
Medium · 6.5
CWE-862 Oct 15, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19575
2026.3.16075
2026.3.16397
2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
CVE-2026-111091
High · 7.8
CWE-829 Oct 15, 2026
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted…
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
CVE-2026-108474
Critical · 9.8
CWE-89 Oct 9, 2026
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of...
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
CVE-2026-106219
High · 7.5
CWE-73 Oct 6, 2026
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed…
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
CVE-2026-106218
Critical · 10.0
CWE-184 Oct 6, 2026
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE…
In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
CVE-2026-103497
Medium · 5.5
CWE-918 Oct 1, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
CVE-2026-103496
Medium · 5.4
CWE-639 Oct 1, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
CVE-2026-103495
Medium · 4.3
CWE-862 Oct 1, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
CVE-2026-103494
Medium · 6.6
CWE-266 Oct 1, 2026
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user…
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
CVE-2026-103493
High · 8.1
CWE-79 Oct 1, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
CVE-2026-103492
Medium · 6.5
CWE-835 Oct 1, 2026
Infinite Loop in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
CVE-2026-103491
Medium · 6.5
CWE-639 Oct 1, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
CVE-2026-103490
High · 7.2
CWE-862 Oct 1, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
CVE-2026-103489
Medium · 5.4
CWE-79 Oct 1, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
CVE-2026-103488
High · 7.1
CWE-863 Oct 1, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
CVE-2026-100280
Medium · 4.3
CWE-862 Sep 30, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
CVE-2026-100279
Medium · 6.5
CWE-918 Sep 30, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
CVE-2026-100278
Medium · 4.9
CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
CVE-2026-100277
Critical · 9.8
CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
CVE-2026-100276
High · 7.5
CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
CVE-2026-100275
Medium · 4.8
CWE-79 Sep 30, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible