JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-29904In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible
- CVE-2025-29903In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible
- CVE-2025-26492In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources
- CVE-2025-26493In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
- CVE-2025-23385In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 202
- CVE-2025-24461In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
- CVE-2025-24460In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
- CVE-2025-24459In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
- CVE-2025-24458In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
- CVE-2025-24457In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
- CVE-2025-24456In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
- CVE-2024-56356In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
- CVE-2024-56355In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
- CVE-2024-56354In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
- CVE-2024-56353In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
- CVE-2024-56352In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
- CVE-2024-56351In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
- CVE-2024-56350In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
- CVE-2024-56349In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
- CVE-2024-56348In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
- CVE-2024-54158In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
- CVE-2024-54157In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector
- CVE-2024-54156In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack
- CVE-2024-54155In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication
- CVE-2024-54154In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
- CVE-2024-54153In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter
- CVE-2024-52555In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script
- CVE-2024-50582In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
- CVE-2024-50581In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag
- CVE-2024-50580In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule