Vulnerabilidades de Jetbrains
CVEs publicadas que afetam produtos de Jetbrains: 189 registro(s), com severidade, exploração e correções.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-100274
Média · 6.5
CWE-770 30/09/2026
Allocation of Resources Without Limits or Throttling em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
CVE-2026-100273
Crítica · 9.8
CWE-863 30/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
CVE-2026-100272
Média · 4.9
CWE-639 30/09/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
CVE-2026-100271
Baixa · 2.7
CWE-862 30/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
CVE-2026-100270
Baixa · 2.7
CWE-863 30/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
CVE-2026-100269
Média · 4.3
CWE-862 30/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
CVE-2026-100268
Baixa · 2.7
CWE-639 30/09/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
CVE-2026-100267
Média · 5.9
CWE-1333 30/09/2026
Inefficient Regular Expression Complexity (ReDoS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
CVE-2026-100266
Média · 6.5
CWE-862 30/09/2026
Missing Authorization em Jetbrains Hub
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
CVE-2026-100265
Média · 6.5
CWE-494 30/09/2026
Download of Code Without Integrity Check em Jetbrains Rider
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
CVE-2026-100264
Baixa · 2.7
CWE-522 30/09/2026
Insufficiently Protected Credentials em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
CVE-2026-100263
Média · 6.1
CWE-79 30/09/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
CVE-2026-100262
Alta · 7.1
CWE-863 30/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
CVE-2026-100261
Média · 5.4
CWE-288 30/09/2026
Authentication Bypass Using an Alternate Path or Channel em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
CVE-2026-100260
Média · 5.3
CWE-1188 30/09/2026
Insecure Default Initialization of Resource em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
CVE-2026-100259
Média · 4.3
CWE-863 30/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
CVE-2026-100258
Média · 4.3
CWE-201 30/09/2026
Insertion of Sensitive Information Into Sent Data em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVE-2026-100257
Média · 4.3
CWE-918 30/09/2026
Server-Side Request Forgery (SSRF) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
CVE-2026-100256
Alta · 7.8
CWE-829 30/09/2026
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints…
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
CVE-2026-100255
Crítica · 9.8
CWE-1289 30/09/2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover…
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account takeover was possible via password reset
CVE-2026-100254
Alta · 8.8
CWE-78 30/09/2026
OS Command Injection em Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
CVE-2026-100253
Alta · 8.8
CWE-184 30/09/2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code…
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
CVE-2026-86506
Média · 5.9
CWE-306 07/09/2026
Missing Authentication for Critical Function em Jetbrains Goland
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data
CVE-2026-86505
Baixa · 3.3
CWE-201 07/09/2026
Insertion of Sensitive Information Into Sent Data em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
CVE-2026-86504
Alta · 7.8
CWE-829 07/09/2026
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before…
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution