# cve.now: JetBrains

The newest entries naming JetBrains as an affected vendor (up to 200), of 545 in all, 4 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123858](https://cve.now/CVE-2026-123858.md): In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects (CVSS 4.4)
- [CVE-2026-123857](https://cve.now/CVE-2026-123857.md): In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection (CVSS 4.3)
- [CVE-2026-123856](https://cve.now/CVE-2026-123856.md): In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server (CVSS 6.5)
- [CVE-2026-123855](https://cve.now/CVE-2026-123855.md): In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs (CVSS 7.5)
- [CVE-2026-123854](https://cve.now/CVE-2026-123854.md): In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module (CVSS 5.5)
- [CVE-2026-123853](https://cve.now/CVE-2026-123853.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the… (CVSS 7.8)
- [CVE-2026-123852](https://cve.now/CVE-2026-123852.md): In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates (CVSS 7.4)
- [CVE-2026-123851](https://cve.now/CVE-2026-123851.md): In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters (CVSS 5.4)
- [CVE-2026-123850](https://cve.now/CVE-2026-123850.md): In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives (CVSS 3.5)
- [CVE-2026-123849](https://cve.now/CVE-2026-123849.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers (CVSS 7.0)
- [CVE-2026-123848](https://cve.now/CVE-2026-123848.md): In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates (CVSS 7.4)
- [CVE-2026-123847](https://cve.now/CVE-2026-123847.md): In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion (CVSS 5.3)
- [CVE-2026-123846](https://cve.now/CVE-2026-123846.md): In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation (CVSS 4.3)
- [CVE-2026-123845](https://cve.now/CVE-2026-123845.md): In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects (CVSS 3.3)
- [CVE-2026-123844](https://cve.now/CVE-2026-123844.md): In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories (CVSS 5.3)
- [CVE-2026-123843](https://cve.now/CVE-2026-123843.md): In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration (CVSS 3.3)
- [CVE-2026-123842](https://cve.now/CVE-2026-123842.md): In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives (CVSS 7.1)
- [CVE-2026-123841](https://cve.now/CVE-2026-123841.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive (CVSS 7.8)
- [CVE-2026-123840](https://cve.now/CVE-2026-123840.md): In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs (CVSS 4.7)
- [CVE-2026-123839](https://cve.now/CVE-2026-123839.md): In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port… (CVSS 4.7)
- [CVE-2026-123838](https://cve.now/CVE-2026-123838.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file (CVSS 7.8)
- [CVE-2026-123837](https://cve.now/CVE-2026-123837.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL (CVSS 7.8)
- [CVE-2026-123836](https://cve.now/CVE-2026-123836.md): In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup (CVSS 8.8)
- [CVE-2026-123835](https://cve.now/CVE-2026-123835.md): In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition (CVSS 5.9)
- [CVE-2026-123834](https://cve.now/CVE-2026-123834.md): In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account (CVSS 7.5)
- [CVE-2026-123833](https://cve.now/CVE-2026-123833.md): In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects (CVSS 3.6)
- [CVE-2026-123832](https://cve.now/CVE-2026-123832.md): In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database (CVSS 9.6)
- [CVE-2026-123831](https://cve.now/CVE-2026-123831.md): In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings (CVSS 9.6)
- [CVE-2026-123337](https://cve.now/CVE-2026-123337.md): In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility (CVSS 3.1)
- [CVE-2026-123336](https://cve.now/CVE-2026-123336.md): In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion (CVSS 3.1)
- [CVE-2026-123335](https://cve.now/CVE-2026-123335.md): In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the… (CVSS 3.5)
- [CVE-2026-123334](https://cve.now/CVE-2026-123334.md): In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project (CVSS 3.8)
- [CVE-2026-123333](https://cve.now/CVE-2026-123333.md): In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints (CVSS 3.8)
- [CVE-2026-123332](https://cve.now/CVE-2026-123332.md): In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations (CVSS 4.7)
- [CVE-2026-123331](https://cve.now/CVE-2026-123331.md): In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles (CVSS 5.4)
- [CVE-2026-123330](https://cve.now/CVE-2026-123330.md): In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings (CVSS 5.4)
- [CVE-2026-123329](https://cve.now/CVE-2026-123329.md): In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions (CVSS 5.4)
- [CVE-2026-123328](https://cve.now/CVE-2026-123328.md): In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab (CVSS 6.4)
- [CVE-2026-123327](https://cve.now/CVE-2026-123327.md): In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions (CVSS 7.5)
- [CVE-2026-123326](https://cve.now/CVE-2026-123326.md): In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension (CVSS 7.1)
- [CVE-2026-123325](https://cve.now/CVE-2026-123325.md): In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin… (CVSS 7.1)
- [CVE-2026-123324](https://cve.now/CVE-2026-123324.md): In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible (CVSS 7.7)
- [CVE-2026-123323](https://cve.now/CVE-2026-123323.md): In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send… (CVSS 8.4)
- [CVE-2026-123322](https://cve.now/CVE-2026-123322.md): In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader (CVSS 6.3)
- [CVE-2026-123321](https://cve.now/CVE-2026-123321.md): In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects (CVSS 7.8)
- [CVE-2026-123320](https://cve.now/CVE-2026-123320.md): In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server (CVSS 3.1)
- [CVE-2026-123319](https://cve.now/CVE-2026-123319.md): In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection (CVSS 3.7)
- [CVE-2026-123318](https://cve.now/CVE-2026-123318.md): In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine (CVSS 4.8)
- [CVE-2026-123317](https://cve.now/CVE-2026-123317.md): In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies (CVSS 8.1)
- [CVE-2026-123316](https://cve.now/CVE-2026-123316.md): In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs (CVSS 5.5)
- [CVE-2026-123315](https://cve.now/CVE-2026-123315.md): In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option (CVSS 7.0)
- [CVE-2026-123314](https://cve.now/CVE-2026-123314.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request (CVSS 3.1)
- [CVE-2026-123313](https://cve.now/CVE-2026-123313.md): In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings (CVSS 3.3)
- [CVE-2026-123312](https://cve.now/CVE-2026-123312.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing (CVSS 3.3)
- [CVE-2026-123311](https://cve.now/CVE-2026-123311.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible (CVSS 5.3)
- [CVE-2026-123310](https://cve.now/CVE-2026-123310.md): In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects (CVSS 5.4)
- [CVE-2026-123309](https://cve.now/CVE-2026-123309.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview (CVSS 6.1)
- [CVE-2026-123308](https://cve.now/CVE-2026-123308.md): In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects (CVSS 6.3)
- [CVE-2026-123307](https://cve.now/CVE-2026-123307.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible (CVSS 6.8)
- [CVE-2026-123306](https://cve.now/CVE-2026-123306.md): In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs (CVSS 7.4)
- [CVE-2026-123305](https://cve.now/CVE-2026-123305.md): In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host (CVSS 7.5)
- [CVE-2026-123304](https://cve.now/CVE-2026-123304.md): In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path (CVSS 7.8)
- [CVE-2026-123302](https://cve.now/CVE-2026-123302.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script… (CVSS 7.8)
- [CVE-2026-123301](https://cve.now/CVE-2026-123301.md): In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible (CVSS 8.2)
- [CVE-2026-123300](https://cve.now/CVE-2026-123300.md): In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings (CVSS 2.7)
- [CVE-2026-123299](https://cve.now/CVE-2026-123299.md): In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible (CVSS 3.1)
- [CVE-2026-123298](https://cve.now/CVE-2026-123298.md): In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible (CVSS 5.0)
- [CVE-2026-123297](https://cve.now/CVE-2026-123297.md): In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow (CVSS 6.8)
- [CVE-2026-123296](https://cve.now/CVE-2026-123296.md): In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible (CVSS 7.5)
- [CVE-2026-123295](https://cve.now/CVE-2026-123295.md): In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint (CVSS 8.1)
- [CVE-2026-123294](https://cve.now/CVE-2026-123294.md): In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow (CVSS 9.6)
- [CVE-2026-123293](https://cve.now/CVE-2026-123293.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting (CVSS 7.8)
- [CVE-2026-123292](https://cve.now/CVE-2026-123292.md): In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid (CVSS 2.7)
- [CVE-2026-123291](https://cve.now/CVE-2026-123291.md): In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook (CVSS 4.3)
- [CVE-2026-123290](https://cve.now/CVE-2026-123290.md): In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content… (CVSS 5.3)
- [CVE-2026-123289](https://cve.now/CVE-2026-123289.md): In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files (CVSS 5.4)
- [CVE-2026-123288](https://cve.now/CVE-2026-123288.md): In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link (CVSS 5.4)
- [CVE-2026-123287](https://cve.now/CVE-2026-123287.md): In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports (CVSS 5.9)
- [CVE-2026-123286](https://cve.now/CVE-2026-123286.md): In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token (CVSS 5.9)
- [CVE-2026-123285](https://cve.now/CVE-2026-123285.md): In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection (CVSS 6.3)
- [CVE-2026-123284](https://cve.now/CVE-2026-123284.md): In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content (CVSS 6.5)
- [CVE-2026-123283](https://cve.now/CVE-2026-123283.md): In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account (CVSS 6.8)
- [CVE-2026-123282](https://cve.now/CVE-2026-123282.md): In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session (CVSS 7.4)
- [CVE-2026-123281](https://cve.now/CVE-2026-123281.md): In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker (CVSS 7.5)
- [CVE-2026-123280](https://cve.now/CVE-2026-123280.md): In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports (CVSS 8.1)
- [CVE-2026-123279](https://cve.now/CVE-2026-123279.md): In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators (CVSS 9.0)
- [CVE-2026-123278](https://cve.now/CVE-2026-123278.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint (CVSS 6.7)
- [CVE-2026-123277](https://cve.now/CVE-2026-123277.md): In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux (CVSS 5.0)
- [CVE-2026-123276](https://cve.now/CVE-2026-123276.md): In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile (CVSS 7.8)
- [CVE-2026-118697](https://cve.now/CVE-2026-118697.md): In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and… (CVSS 9.0)
- [CVE-2026-118696](https://cve.now/CVE-2026-118696.md): In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before… (CVSS 8.0)
- [CVE-2026-117530](https://cve.now/CVE-2026-117530.md): In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands (CVSS 6.7)
- [CVE-2026-111096](https://cve.now/CVE-2026-111096.md): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible (CVSS 6.7)
- [CVE-2026-111095](https://cve.now/CVE-2026-111095.md): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible (CVSS 8.0)
- [CVE-2026-111094](https://cve.now/CVE-2026-111094.md): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was p (CVSS 8.1)
- [CVE-2026-111093](https://cve.now/CVE-2026-111093.md): In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files (CVSS 7.5)
- [CVE-2026-111092](https://cve.now/CVE-2026-111092.md): In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project (CVSS 6.5)
- [CVE-2026-111091](https://cve.now/CVE-2026-111091.md): In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration (CVSS 7.8)
- [CVE-2026-108474](https://cve.now/CVE-2026-108474.md): In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions (CVSS 9.8)
- [CVE-2026-106219](https://cve.now/CVE-2026-106219.md): In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server (CVSS 6.5)
- [CVE-2026-106218](https://cve.now/CVE-2026-106218.md): In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible (CVSS 8.8)
- [CVE-2026-103497](https://cve.now/CVE-2026-103497.md): In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration (CVSS 5.5)
- [CVE-2026-103496](https://cve.now/CVE-2026-103496.md): In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications (CVSS 5.4)
- [CVE-2026-103495](https://cve.now/CVE-2026-103495.md): In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs (CVSS 4.3)
- [CVE-2026-103494](https://cve.now/CVE-2026-103494.md): In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes (CVSS 6.6)
- [CVE-2026-103493](https://cve.now/CVE-2026-103493.md): In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible (CVSS 8.1)
- [CVE-2026-103492](https://cve.now/CVE-2026-103492.md): In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments (CVSS 6.5)
- [CVE-2026-103491](https://cve.now/CVE-2026-103491.md): In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues (CVSS 6.5)
- [CVE-2026-103490](https://cve.now/CVE-2026-103490.md): In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links (CVSS 7.2)
- [CVE-2026-103489](https://cve.now/CVE-2026-103489.md): In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible (CVSS 2.0)
- [CVE-2026-103488](https://cve.now/CVE-2026-103488.md): In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re (CVSS 7.1)
- [CVE-2026-100280](https://cve.now/CVE-2026-100280.md): In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible (CVSS 3.1)
- [CVE-2026-100279](https://cve.now/CVE-2026-100279.md): In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials (CVSS 6.5)
- [CVE-2026-100278](https://cve.now/CVE-2026-100278.md): In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments (CVSS 4.9)
- [CVE-2026-100277](https://cve.now/CVE-2026-100277.md): In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature (CVSS 8.9)
- [CVE-2026-100276](https://cve.now/CVE-2026-100276.md): In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action (CVSS 5.9)
- [CVE-2026-100275](https://cve.now/CVE-2026-100275.md): In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible (CVSS 6.9)
- [CVE-2026-100274](https://cve.now/CVE-2026-100274.md): In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template (CVSS 6.5)
- [CVE-2026-100273](https://cve.now/CVE-2026-100273.md): In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution (CVSS 8.2)
- [CVE-2026-100272](https://cve.now/CVE-2026-100272.md): In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read (CVSS 4.9)
- [CVE-2026-100271](https://cve.now/CVE-2026-100271.md): In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from (CVSS 2.7)
- [CVE-2026-100270](https://cve.now/CVE-2026-100270.md): In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurat (CVSS 3.3)
- [CVE-2026-100269](https://cve.now/CVE-2026-100269.md): In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed (CVSS 4.3)
- [CVE-2026-100268](https://cve.now/CVE-2026-100268.md): In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates (CVSS 7.7)
- [CVE-2026-100267](https://cve.now/CVE-2026-100267.md): In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters (CVSS 5.9)
- [CVE-2026-100266](https://cve.now/CVE-2026-100266.md): In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted ad (CVSS 7.7)
- [CVE-2026-100265](https://cve.now/CVE-2026-100265.md): In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation (CVSS 4.8)
- [CVE-2026-100264](https://cve.now/CVE-2026-100264.md): In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host (CVSS 2.7)
- [CVE-2026-100263](https://cve.now/CVE-2026-100263.md): In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible (CVSS 4.7)
- [CVE-2026-100262](https://cve.now/CVE-2026-100262.md): In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notificatio (CVSS 7.6)
- [CVE-2026-100261](https://cve.now/CVE-2026-100261.md): In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission (CVSS 5.4)
- [CVE-2026-100260](https://cve.now/CVE-2026-100260.md): In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset (CVSS 5.3)
- [CVE-2026-100259](https://cve.now/CVE-2026-100259.md): In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access (CVSS 4.3)
- [CVE-2026-100258](https://cve.now/CVE-2026-100258.md): In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings (CVSS 4.3)
- [CVE-2026-100257](https://cve.now/CVE-2026-100257.md): In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export (CVSS 4.3)
- [CVE-2026-100256](https://cve.now/CVE-2026-100256.md): In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects (CVSS 7.8)
- [CVE-2026-100255](https://cve.now/CVE-2026-100255.md): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset (CVSS 8.1)
- [CVE-2026-100254](https://cve.now/CVE-2026-100254.md): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection (CVSS 8.8)
- [CVE-2026-100253](https://cve.now/CVE-2026-100253.md): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings (CVSS 8.8)
- [CVE-2026-86506](https://cve.now/CVE-2026-86506.md): In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data (CVSS 5.9)
- [CVE-2026-86505](https://cve.now/CVE-2026-86505.md): In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace (CVSS 3.3)
- [CVE-2026-86504](https://cve.now/CVE-2026-86504.md): In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execut (CVSS 7.8)
- [CVE-2026-86503](https://cve.now/CVE-2026-86503.md): In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching (CVSS 3.3)
- [CVE-2026-86502](https://cve.now/CVE-2026-86502.md): In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote De (CVSS 8.4)
- [CVE-2026-86501](https://cve.now/CVE-2026-86501.md): In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log (CVSS 2.8)
- [CVE-2026-86500](https://cve.now/CVE-2026-86500.md): In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Adm (CVSS 5.5)
- [CVE-2026-86499](https://cve.now/CVE-2026-86499.md): In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission (CVSS 4.3)
- [CVE-2026-86498](https://cve.now/CVE-2026-86498.md): In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without up (CVSS 7.7)
- [CVE-2026-86497](https://cve.now/CVE-2026-86497.md): In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate st (CVSS 6.8)
- [CVE-2026-86496](https://cve.now/CVE-2026-86496.md): In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses (CVSS 4.3)
- [CVE-2026-86495](https://cve.now/CVE-2026-86495.md): In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects (CVSS 6.5)
- [CVE-2026-86494](https://cve.now/CVE-2026-86494.md): In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues (CVSS 7.7)
- [CVE-2026-86493](https://cve.now/CVE-2026-86493.md): In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards (CVSS 6.5)
- [CVE-2026-86492](https://cve.now/CVE-2026-86492.md): In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens (CVSS 8.5)
- [CVE-2026-86491](https://cve.now/CVE-2026-86491.md): In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads (CVSS 3.5)
- [CVE-2026-86490](https://cve.now/CVE-2026-86490.md): In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint (CVSS 6.5)
- [CVE-2026-86489](https://cve.now/CVE-2026-86489.md): In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations (CVSS 6.5)
- [CVE-2026-86488](https://cve.now/CVE-2026-86488.md): In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches (CVSS 6.5)
- [CVE-2026-86487](https://cve.now/CVE-2026-86487.md): In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content (CVSS 3.1)
- [CVE-2026-86486](https://cve.now/CVE-2026-86486.md): In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank (CVSS 3.7)
- [CVE-2026-86485](https://cve.now/CVE-2026-86485.md): In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks (CVSS 3.5)
- [CVE-2026-86484](https://cve.now/CVE-2026-86484.md): In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS (CVSS 4.6)
- [CVE-2026-86483](https://cve.now/CVE-2026-86483.md): In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible (CVSS 5.4)
- [CVE-2026-86482](https://cve.now/CVE-2026-86482.md): In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation (CVSS 8.8)
- [CVE-2026-86481](https://cve.now/CVE-2026-86481.md): In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons (CVSS 4.3)
- [CVE-2026-86480](https://cve.now/CVE-2026-86480.md): In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges (CVSS 9.8)
- [CVE-2026-86479](https://cve.now/CVE-2026-86479.md): In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resourc (CVSS 8.0)
- [CVE-2026-86478](https://cve.now/CVE-2026-86478.md): In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeo (CVSS 9.8)
- [CVE-2026-75060](https://cve.now/CVE-2026-75060.md): In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools (CVSS 8.4)
- [CVE-2026-75059](https://cve.now/CVE-2026-75059.md): In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible (CVSS 4.4)
- [CVE-2026-75058](https://cve.now/CVE-2026-75058.md): In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers (CVSS 5.5)
- [CVE-2026-75057](https://cve.now/CVE-2026-75057.md): In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log (CVSS 6.2)
- [CVE-2026-75056](https://cve.now/CVE-2026-75056.md): In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible (CVSS 7.8)
- [CVE-2026-75055](https://cve.now/CVE-2026-75055.md): In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE (CVSS 5.5)
- [CVE-2026-75054](https://cve.now/CVE-2026-75054.md): In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects (CVSS 6.3)
- [CVE-2026-75053](https://cve.now/CVE-2026-75053.md): In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint (CVSS 5.4)
- [CVE-2026-75052](https://cve.now/CVE-2026-75052.md): In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects (CVSS 3.6)
- [CVE-2026-75051](https://cve.now/CVE-2026-75051.md): In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible (CVSS 8.1)
- [CVE-2026-75050](https://cve.now/CVE-2026-75050.md): In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters (CVSS 7.1)
- [CVE-2026-75049](https://cve.now/CVE-2026-75049.md): In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the dr (CVSS 6.5)
- [CVE-2026-75048](https://cve.now/CVE-2026-75048.md): In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible (CVSS 8.2)
- [CVE-2026-75047](https://cve.now/CVE-2026-75047.md): In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint (CVSS 6.5)
- [CVE-2026-75046](https://cve.now/CVE-2026-75046.md): In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint (CVSS 4.3)
- [CVE-2026-75045](https://cve.now/CVE-2026-75045.md): In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via sha (CVSS 9.1)
- [CVE-2026-75044](https://cve.now/CVE-2026-75044.md): In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbit (CVSS 8.1)
- [CVE-2026-68762](https://cve.now/CVE-2026-68762.md): In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible (CVSS 5.9)
- [CVE-2026-63077](https://cve.now/CVE-2026-63077.md): In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol (CVSS 9.8, KEV)
- [CVE-2026-65907](https://cve.now/CVE-2026-65907.md): In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible (CVSS 9.1)
- [CVE-2026-65908](https://cve.now/CVE-2026-65908.md): In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open (CVSS 8.6)
- [CVE-2026-65906](https://cve.now/CVE-2026-65906.md): In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible (CVSS 8.8)
- [CVE-2026-64815](https://cve.now/CVE-2026-64815.md): In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files (CVSS 8.1)
- [CVE-2026-64814](https://cve.now/CVE-2026-64814.md): In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session (CVSS 8.6)
- [CVE-2026-64813](https://cve.now/CVE-2026-64813.md): In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session (CVSS 10.0)
- [CVE-2026-64812](https://cve.now/CVE-2026-64812.md): In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session (CVSS 10.0)
- [CVE-2026-64811](https://cve.now/CVE-2026-64811.md): In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container confi (CVSS 7.8)
- [CVE-2026-64810](https://cve.now/CVE-2026-64810.md): In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking (CVSS 4.3)
- [CVE-2026-64809](https://cve.now/CVE-2026-64809.md): In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter (CVSS 8.4)
- [CVE-2026-64808](https://cve.now/CVE-2026-64808.md): In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling (CVSS 8.4)
- [CVE-2026-64807](https://cve.now/CVE-2026-64807.md): In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration (CVSS 7.8)
- [CVE-2026-64806](https://cve.now/CVE-2026-64806.md): In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpret (CVSS 8.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jetbrains
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.