Vulnerabilidades de Jetbrains
CVEs publicadas que afetam produtos de Jetbrains: 80 registro(s), com severidade, exploração e correções.
Teamcity 37Youtrack 18Hub 8Intellij Idea 6Datalore 2Pycharm 2Resharper 2Junie 1Dottrace 1Rider 1Goland 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1
CVE-2026-111096
Média · 6.7
CWE-79 15/10/2026
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible
CVE-2026-111095
Alta · 8.0
CWE-79 15/10/2026
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possible
CVE-2026-111094
Alta · 8.1
CWE-502 15/10/2026
Deserialization of Untrusted Data em Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVE-2026-111093
Alta · 7.5
CWE-23 15/10/2026
Relative Path Traversal em Jetbrains Datalore
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
CVE-2026-111092
Média · 6.5
CWE-862 15/10/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19575
2026.3.16075
2026.3.16397
2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
CVE-2026-111091
Alta · 7.8
CWE-829 15/10/2026
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted…
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
CVE-2026-108474
Crítica · 9.8
CWE-89 09/10/2026
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of...
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
CVE-2026-106219
Alta · 7.5
CWE-73 06/10/2026
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed…
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
CVE-2026-106218
Crítica · 10.0
CWE-184 06/10/2026
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE…
In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
CVE-2026-100254
Alta · 8.8
CWE-78 30/09/2026
OS Command Injection em Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
CVE-2026-100253
Alta · 8.8
CWE-184 30/09/2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code…
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
CVE-2026-63077
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-502 27/07/2026
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-57926
Crítica · 9.8
CWE-1321 26/06/2026
Prototype Pollution na ponte websandbox do JetBrains YouTrack
Na JetBrains YouTrack anterior à versão 2026.2.16593, a ponte websandbox era vulnerável a um ataque de prototype pollution
CVE-2026-57925
Média · 5.3
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVE-2026-57924
Média · 5.3
CWE-276 26/06/2026
Incorrect Default Permissions em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVE-2026-57923
Alta · 7.5
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
CVE-2026-57922
Média · 5.3
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVE-2026-57921
Alta · 7.5
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVE-2026-53914
Crítica · 9.8
CWE-502 26/06/2026
Desserialização insegura nos metadados do cache de build do JetBrains Kotlin (CVE-2026-53914)
No JetBrains Kotlin anterior à versão 2.4.20, era possível executar código por meio de desserialização insegura nos metadados do cache de build.
CVE-2026-56142
Alta · 8.8
CWE-915 19/06/2026
Mass Assignment em Jetbrains Hub
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
CVE-2026-56141
Crítica · 9.8
CWE-338 19/06/2026
JetBrains Hub: tomada de conta por códigos de restauração previsíveis (CWE-338)
No JetBrains Hub antes de 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430 e 2024.2.148429, era possível a tomada de conta por meio de códigos de restauração previsíveis.
CVE-2026-53915
Alta · 8.8
CWE-73 19/06/2026
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted…
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration
CVE-2026-50242
Crítica · 9.8
CWE-306 19/06/2026
Bypass de autenticação no JetBrains Hub via acesso direto ao banco de dados (CVE-2026-50242)
Em JetBrains Hub antes de 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 bypass de autenticação via acesso direto ao banco de dados levando a acesso administrativo era possível
CVE-2026-49386
Média · 6.5
CWE-639 29/05/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
CVE-2026-49385
Média · 6.5
CWE-862 29/05/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts