Vulnerabilidades de Jetbrains
CVEs publicadas que afetam produtos de Jetbrains: 189 registro(s), com severidade, exploração e correções.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-49368
Média · 5.4
CWE-79 29/05/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
CVE-2026-49367
Alta · 8.8
CWE-862 29/05/2026
Missing Authorization em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
CVE-2026-49366
Alta · 7.8
CWE-78 29/05/2026
OS Command Injection em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
CVE-2026-44413
Alta · 7.5
CWE-306 11/05/2026
Missing Authentication for Critical Function em Jetbrains Teamcity
In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access
CVE-2026-41882
Alta · 7.5
CWE-59 30/04/2026
Link Following em Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2024.3.7.1,
2025.1.7.1,
2025.2.6.2,
2025.3.4.1,
2026.1.1 reading arbitrary local files was possible via built-in web server
CVE-2026-41153
Crítica · 9.8
CWE-77 17/04/2026
Command Injection em Jetbrains Junie
In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
CVE-2026-33392
Alta · 7.2
CWE-1336 17/04/2026
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via…
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
CVE-2026-32745
Média · 5.7
CWE-319 13/03/2026
Cleartext Transmission of Sensitive Information em Jetbrains Datalore
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
CVE-2026-32229
Média · 6.8
CWE-290 11/03/2026
Authentication Bypass by Spoofing em Jetbrains Hub
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
CVE-2026-28196
Baixa · 2.3
CWE-459 25/02/2026
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials…
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
CVE-2026-28195
Média · 4.3
CWE-862 25/02/2026
Missing Authorization em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
CVE-2026-28194
Média · 6.1
CWE-601 25/02/2026
Open Redirect em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
CVE-2026-28193
Média · 5.3
CWE-862 25/02/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
CVE-2026-25848
Crítica · 9.8
CWE-306 09/02/2026
Bypass de autenticação no JetBrains Hub (CWE-306)
No JetBrains Hub antes da versão 2025.3.119807, era possível um bypass de autenticação que permitia ações administrativas.
CVE-2026-25847
Média · 6.1
CWE-79 09/02/2026
Cross-site Scripting (XSS) em Jetbrains Pycharm
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
CVE-2026-25846
Média · 6.5
CWE-532 09/02/2026
Insertion of Sensitive Information into Log File em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
CVE-2025-68269
Média · 5.4
CWE-349 16/12/2025
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of…
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
CVE-2025-68268
Média · 6.1
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
CVE-2025-68267
Média · 6.5
CWE-272 16/12/2025
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing…
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
CVE-2025-68166
Média · 6.1
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
CVE-2025-68165
Média · 6.1
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
CVE-2025-68164
Baixa · 2.7
CWE-203 16/12/2025
Observable Discrepancy em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
CVE-2025-68163
Média · 4.8
CWE-79 16/12/2025
Cross-site Scripting (XSS) em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
CVE-2025-68162
Baixa · 2.7
CWE-829 16/12/2025
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via…
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
CVE-2025-67742
Alta · 7.5
CWE-22 11/12/2025
Path Traversal em Jetbrains Teamcity
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload