JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-49370In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
- CVE-2026-49369In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
- CVE-2026-49368In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
- CVE-2026-49367In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
- CVE-2026-49366In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion
- CVE-2026-44413In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
- CVE-2026-41882In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible vi
- CVE-2026-41153In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
- CVE-2026-33392In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
- CVE-2026-32745In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
- CVE-2026-32229In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
- CVE-2026-28196In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
- CVE-2026-28195In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
- CVE-2026-28194In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
- CVE-2026-28193In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
- CVE-2026-25848In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
- CVE-2026-25847In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
- CVE-2026-25846In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
- CVE-2025-68269In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH
- CVE-2025-68268In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
- CVE-2025-68267In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installa
- CVE-2025-68166In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
- CVE-2025-68165In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
- CVE-2025-68164In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
- CVE-2025-68163In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
- CVE-2025-68162In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
- CVE-2025-67742In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
- CVE-2025-67741In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
- CVE-2025-67740In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
- CVE-2025-67739In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure