Vulnerabilidades de Jetbrains
CVEs publicadas que afetam produtos de Jetbrains: 189 registro(s), com severidade, exploração e correções.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-57922
Média · 5.3
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVE-2026-57921
Alta · 7.5
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVE-2026-53914
Crítica · 9.8
CWE-502 26/06/2026
Desserialização insegura nos metadados do cache de build do JetBrains Kotlin (CVE-2026-53914)
No JetBrains Kotlin anterior à versão 2.4.20, era possível executar código por meio de desserialização insegura nos metadados do cache de build.
CVE-2026-56142
Alta · 8.8
CWE-915 19/06/2026
Mass Assignment em Jetbrains Hub
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
CVE-2026-56141
Crítica · 9.8
CWE-338 19/06/2026
JetBrains Hub: tomada de conta por códigos de restauração previsíveis (CWE-338)
No JetBrains Hub antes de 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430 e 2024.2.148429, era possível a tomada de conta por meio de códigos de restauração previsíveis.
CVE-2026-53915
Alta · 8.8
CWE-73 19/06/2026
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted…
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration
CVE-2026-50242
Crítica · 9.8
CWE-306 19/06/2026
Bypass de autenticação no JetBrains Hub via acesso direto ao banco de dados (CVE-2026-50242)
Em JetBrains Hub antes de 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 bypass de autenticação via acesso direto ao banco de dados levando a acesso administrativo era possível
CVE-2026-49386
Média · 6.5
CWE-639 29/05/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
CVE-2026-49385
Média · 6.5
CWE-862 29/05/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
CVE-2026-49384
Média · 6.1
CWE-79 29/05/2026
Cross-site Scripting (XSS) em Jetbrains Pycharm
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
CVE-2026-49383
Baixa · 3.3
CWE-611 29/05/2026
XML External Entity (XXE) em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
CVE-2026-49382
Alta · 7.8
CWE-1336 29/05/2026
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template…
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
CVE-2026-49381
Média · 4.8
CWE-79 29/05/2026
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
CVE-2026-49380
Média · 6.1
CWE-601 29/05/2026
Open Redirect em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
CVE-2026-49379
Média · 6.5
CWE-522 29/05/2026
Insufficiently Protected Credentials em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
CVE-2026-49378
Média · 4.3
CWE-862 29/05/2026
Missing Authorization em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
CVE-2026-49377
Média · 4.3
CWE-526 29/05/2026
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent…
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
CVE-2026-49376
Média · 6.5
CWE-863 29/05/2026
Incorrect Authorization em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
CVE-2026-49375
Média · 6.1
CWE-79 29/05/2026
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page
CVE-2026-49374
Alta · 7.6
CWE-862 29/05/2026
Missing Authorization em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
CVE-2026-49373
Alta · 8.8
CWE-88 29/05/2026
Argument Injection em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
CVE-2026-49372
Alta · 7.5
CWE-918 29/05/2026
Server-Side Request Forgery (SSRF) em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible
CVE-2026-49371
Alta · 8.2
CWE-79 29/05/2026
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
CVE-2026-49370
Alta · 7.5
CWE-201 29/05/2026
Insertion of Sensitive Information Into Sent Data em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
CVE-2026-49369
Média · 4.3
CWE-863 29/05/2026
Incorrect Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages