JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-86495In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
- CVE-2026-86494In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
- CVE-2026-86493In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
- CVE-2026-86492In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
- CVE-2026-86491In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
- CVE-2026-86490In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
- CVE-2026-86489In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
- CVE-2026-86488In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches
- CVE-2026-86487In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
- CVE-2026-86486In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
- CVE-2026-86485In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
- CVE-2026-86484In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
- CVE-2026-86483In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
- CVE-2026-86482In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
- CVE-2026-86481In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
- CVE-2026-86480In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
- CVE-2026-86479In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resourc
- CVE-2026-86478In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeo
- CVE-2026-75060In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
- CVE-2026-75059In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
- CVE-2026-75058In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
- CVE-2026-75057In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
- CVE-2026-75056In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible
- CVE-2026-75055In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
- CVE-2026-75054In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
- CVE-2026-75053In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
- CVE-2026-75052In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
- CVE-2026-75051In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
- CVE-2026-75050In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
- CVE-2026-75049In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the dr