Jetbrains vulnerabilities

Published CVEs affecting Jetbrains products: 189 record(s), with severity, exploitation and fixes.

Youtrack 83 Teamcity 44 Intellij Idea 26 Hub 10 Pycharm 5 Goland 5 Webstorm 4 Rider 2 Phpstorm 2 Resharper 2 Datalore 2 Dottrace 1 Kotlin 1 Exposed 1 ReSharper, Rider and dotTrace 1 Junie CLI 1 Junie 1 Ktor 1

Exploited only (KEV) →

CVE-2026-57922 Medium · 5.3 CWE-862 Jun 26, 2026

Missing Authorization in Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

CVE-2026-57921 High · 7.5 CWE-862 Jun 26, 2026

Missing Authorization in Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

CVE-2026-53914 Critical · 9.8 CWE-502 Jun 26, 2026

JetBrains Kotlin Unsafe Deserialization in Build Cache Metadata (CVE-2026-53914)

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

CVE-2026-56142 High · 8.8 CWE-915 Jun 19, 2026

Mass Assignment in Jetbrains Hub

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

CVE-2026-56141 Critical · 9.8 CWE-338 Jun 19, 2026

JetBrains Hub: account takeover via predictable restore codes (CWE-338)

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

CVE-2026-53915 High · 8.8 CWE-73 Jun 19, 2026

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted…

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

CVE-2026-50242 Critical · 9.8 CWE-306 Jun 19, 2026

JetBrains Hub authentication bypass via direct database access (CVE-2026-50242)

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

CVE-2026-49386 Medium · 6.5 CWE-639 May 29, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

CVE-2026-49385 Medium · 6.5 CWE-862 May 29, 2026

Missing Authorization in Jetbrains Youtrack

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

CVE-2026-49384 Medium · 6.1 CWE-79 May 29, 2026

Cross-site Scripting (XSS) in Jetbrains Pycharm

In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible

CVE-2026-49383 Low · 3.3 CWE-611 May 29, 2026

XML External Entity (XXE) in Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

CVE-2026-49382 High · 7.8 CWE-1336 May 29, 2026

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template…

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

CVE-2026-49381 Medium · 4.8 CWE-79 May 29, 2026

Cross-site Scripting (XSS) in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

CVE-2026-49380 Medium · 6.1 CWE-601 May 29, 2026

Open Redirect in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible

CVE-2026-49379 Medium · 6.5 CWE-522 May 29, 2026

Insufficiently Protected Credentials in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

CVE-2026-49378 Medium · 4.3 CWE-862 May 29, 2026

Missing Authorization in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

CVE-2026-49377 Medium · 4.3 CWE-526 May 29, 2026

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent…

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

CVE-2026-49376 Medium · 6.5 CWE-863 May 29, 2026

Incorrect Authorization in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

CVE-2026-49375 Medium · 6.1 CWE-79 May 29, 2026

Cross-site Scripting (XSS) in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page

CVE-2026-49374 High · 7.6 CWE-862 May 29, 2026

Missing Authorization in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

CVE-2026-49373 High · 8.8 CWE-88 May 29, 2026

Argument Injection in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

CVE-2026-49372 High · 7.5 CWE-918 May 29, 2026

Server-Side Request Forgery (SSRF) in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

CVE-2026-49371 High · 8.2 CWE-79 May 29, 2026

Cross-site Scripting (XSS) in Jetbrains Teamcity

In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

CVE-2026-49370 High · 7.5 CWE-201 May 29, 2026

Insertion of Sensitive Information Into Sent Data in Jetbrains Youtrack

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

CVE-2026-49369 Medium · 4.3 CWE-863 May 29, 2026

Incorrect Authorization in Jetbrains Youtrack

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages