Vulnerabilidades de Jetbrains
CVEs publicadas que afetam produtos de Jetbrains: 189 registro(s), com severidade, exploração e correções.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-86503
Baixa · 3.3
CWE-918 07/09/2026
Server-Side Request Forgery (SSRF) em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching
CVE-2026-86502
Alta · 8.4
CWE-306 07/09/2026
Missing Authentication for Critical Function em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
CVE-2026-86501
Baixa · 2.8
CWE-532 07/09/2026
Insertion of Sensitive Information into Log File em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
CVE-2026-86500
Média · 5.5
CWE-266 07/09/2026
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with…
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
CVE-2026-86499
Média · 4.3
CWE-862 07/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
CVE-2026-86498
Alta · 7.7
CWE-863 07/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
CVE-2026-86497
Média · 6.8
CWE-201 07/09/2026
Insertion of Sensitive Information Into Sent Data em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
CVE-2026-86496
Média · 4.3
CWE-862 07/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses
CVE-2026-86495
Média · 6.5
CWE-862 07/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
CVE-2026-86494
Alta · 7.7
CWE-862 07/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
CVE-2026-86493
Média · 6.5
CWE-863 07/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
CVE-2026-86492
Alta · 8.5
CWE-488 07/09/2026
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant…
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
CVE-2026-86491
Baixa · 3.5
CWE-79 07/09/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
CVE-2026-86490
Média · 6.5
CWE-863 07/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
CVE-2026-86489
Média · 6.5
CWE-639 07/09/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
CVE-2026-86488
Média · 6.5
CWE-639 07/09/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches
CVE-2026-86487
Baixa · 3.1
CWE-863 07/09/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
CVE-2026-86486
Baixa · 3.7
CWE-306 07/09/2026
Missing Authentication for Critical Function em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
CVE-2026-86485
Baixa · 3.3
CWE-291 07/09/2026
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged…
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
CVE-2026-86484
Média · 4.6
CWE-79 07/09/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
CVE-2026-86483
Média · 5.4
CWE-79 07/09/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
CVE-2026-86482
Alta · 8.8
CWE-266 07/09/2026
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments…
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
CVE-2026-86481
Média · 4.3
CWE-639 07/09/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
CVE-2026-86480
Crítica · 9.8
CWE-306 07/09/2026
Missing Authentication for Critical Function em Jetbrains Hub
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
CVE-2026-86479
Alta · 8.1
CWE-862 07/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR