CVE Intelligence

Jetbrains vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Jetbrains products: 189 record(s), with severity, exploitation and fixes.

Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1

Exploited only (KEV) →

CVE-2026-100274 Medium · 6.5 CWE-770 Sep 30, 2026
Allocation of Resources Without Limits or Throttling in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
CVE-2026-100273 Critical · 9.8 CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
CVE-2026-100272 Medium · 4.9 CWE-639 Sep 30, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
CVE-2026-100271 Low · 2.7 CWE-862 Sep 30, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
CVE-2026-100270 Low · 2.7 CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
CVE-2026-100269 Medium · 4.3 CWE-862 Sep 30, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
CVE-2026-100268 Low · 2.7 CWE-639 Sep 30, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
CVE-2026-100267 Medium · 5.9 CWE-1333 Sep 30, 2026
Inefficient Regular Expression Complexity (ReDoS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
CVE-2026-100266 Medium · 6.5 CWE-862 Sep 30, 2026
Missing Authorization in Jetbrains Hub
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
CVE-2026-100265 Medium · 6.5 CWE-494 Sep 30, 2026
Download of Code Without Integrity Check in Jetbrains Rider
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
CVE-2026-100264 Low · 2.7 CWE-522 Sep 30, 2026
Insufficiently Protected Credentials in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
CVE-2026-100263 Medium · 6.1 CWE-79 Sep 30, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
CVE-2026-100262 High · 7.1 CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
CVE-2026-100261 Medium · 5.4 CWE-288 Sep 30, 2026
Authentication Bypass Using an Alternate Path or Channel in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
CVE-2026-100260 Medium · 5.3 CWE-1188 Sep 30, 2026
Insecure Default Initialization of Resource in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
CVE-2026-100259 Medium · 4.3 CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
CVE-2026-100258 Medium · 4.3 CWE-201 Sep 30, 2026
Insertion of Sensitive Information Into Sent Data in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVE-2026-100257 Medium · 4.3 CWE-918 Sep 30, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
CVE-2026-100256 High · 7.8 CWE-829 Sep 30, 2026
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints…
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
CVE-2026-100255 Critical · 9.8 CWE-1289 Sep 30, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover…
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
CVE-2026-100254 High · 8.8 CWE-78 Sep 30, 2026
OS Command Injection in Jetbrains Teamcity
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
CVE-2026-100253 High · 8.8 CWE-184 Sep 30, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code…
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
CVE-2026-86506 Medium · 5.9 CWE-306 Sep 7, 2026
Missing Authentication for Critical Function in Jetbrains Goland
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data
CVE-2026-86505 Low · 3.3 CWE-201 Sep 7, 2026
Insertion of Sensitive Information Into Sent Data in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
CVE-2026-86504 High · 7.8 CWE-829 Sep 7, 2026
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before…
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution