JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-118696In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before…
- CVE-2026-117530In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
- CVE-2026-111096In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
- CVE-2026-111095In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
- CVE-2026-111094In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was p
- CVE-2026-111093In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
- CVE-2026-111092In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project
- CVE-2026-111091In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
- CVE-2026-108474In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
- CVE-2026-106219In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
- CVE-2026-106218In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
- CVE-2026-103497In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
- CVE-2026-103496In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
- CVE-2026-103495In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
- CVE-2026-103494In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
- CVE-2026-103493In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
- CVE-2026-103492In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
- CVE-2026-103491In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
- CVE-2026-103490In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
- CVE-2026-103489In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
- CVE-2026-103488In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re
- CVE-2026-100280In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
- CVE-2026-100279In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
- CVE-2026-100278In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
- CVE-2026-100277In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
- CVE-2026-100276In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
- CVE-2026-100275In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
- CVE-2026-100274In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
- CVE-2026-100273In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
- CVE-2026-100272In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read