JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-123335In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the…
- CVE-2026-123334In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
- CVE-2026-123333In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
- CVE-2026-123332In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
- CVE-2026-123331In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
- CVE-2026-123330In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
- CVE-2026-123329In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
- CVE-2026-123328In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
- CVE-2026-123327In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
- CVE-2026-123326In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
- CVE-2026-123325In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin…
- CVE-2026-123324In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
- CVE-2026-123323In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send…
- CVE-2026-123322In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
- CVE-2026-123321In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects
- CVE-2026-123320In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
- CVE-2026-123319In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
- CVE-2026-123318In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
- CVE-2026-123317In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
- CVE-2026-123316In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
- CVE-2026-123315In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
- CVE-2026-123314In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
- CVE-2026-123313In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
- CVE-2026-123312In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
- CVE-2026-123311In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
- CVE-2026-123310In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects
- CVE-2026-123309In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
- CVE-2026-123308In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
- CVE-2026-123307In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
- CVE-2026-123306In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs