JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-59793In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
- CVE-2026-59792In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible
- CVE-2026-59791In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
- CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
- CVE-2026-57926In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
- CVE-2026-57925In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
- CVE-2026-57924In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
- CVE-2026-57923In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
- CVE-2026-57922In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
- CVE-2026-57921In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
- CVE-2026-50242In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via di
- CVE-2026-56142In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by atta
- CVE-2026-56141In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predict
- CVE-2026-53915In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration
- CVE-2026-49386In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
- CVE-2026-49385In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
- CVE-2026-49384In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
- CVE-2026-49383In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
- CVE-2026-49382In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
- CVE-2026-49381In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
- CVE-2026-49380In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
- CVE-2026-49379In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
- CVE-2026-49378In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
- CVE-2026-49377In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
- CVE-2026-49376In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
- CVE-2026-49375In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
- CVE-2026-49374In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
- CVE-2026-49373In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
- CVE-2026-49372In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
- CVE-2026-49371In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible