JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-100271In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from
- CVE-2026-100270In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurat
- CVE-2026-100269In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
- CVE-2026-100268In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
- CVE-2026-100267In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
- CVE-2026-100266In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted ad
- CVE-2026-100265In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
- CVE-2026-100264In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
- CVE-2026-100263In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
- CVE-2026-100262In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notificatio
- CVE-2026-100261In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
- CVE-2026-100260In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
- CVE-2026-100259In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
- CVE-2026-100258In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
- CVE-2026-100257In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
- CVE-2026-100256In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
- CVE-2026-100255In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
- CVE-2026-100254In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection
- CVE-2026-100253In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings
- CVE-2026-86506In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data
- CVE-2026-86505In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
- CVE-2026-86504In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execut
- CVE-2026-86503In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching
- CVE-2026-86502In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote De
- CVE-2026-86501In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
- CVE-2026-86500In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Adm
- CVE-2026-86499In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
- CVE-2026-86498In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without up
- CVE-2026-86497In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate st
- CVE-2026-86496In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses