[ Vendor · 51 CVEs ]
JetBrains
CVEs affecting JetBrains published in the last 30 days, plus any JetBrains CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111095 | 15 Oct 2026 | CVSS 5.4 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible | |
| CVE-2026-111096 | 15 Oct 2026 | CVSS 5.4 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible | |
| CVE-2026-111091 | 15 Oct 2026 | CVSS 7.8 | JetBrains Junie CLIIn JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration | |
| CVE-2026-111092 | 15 Oct 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue… | |
| CVE-2026-111093 | 15 Oct 2026 | CVSS 7.5 | JetBrains DataloreIn JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files | |
| CVE-2026-111094 | 15 Oct 2026 | CVSS 9.8 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible | |
| CVE-2026-108474 | 10 Oct 2026 | CVSS 9.8 | JetBrains ExposedIn JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions | |
| CVE-2026-106218 | 6 Oct 2026 | CVSS 10.0 | JetBrains TeamCityIn JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible | |
| CVE-2026-106219 | 6 Oct 2026 | CVSS 7.5 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server | |
| CVE-2026-103495 | 1 Oct 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | |
| CVE-2026-103496 | 1 Oct 2026 | CVSS 5.4 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications | |
| CVE-2026-103497 | 1 Oct 2026 | CVSS 5.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration | |
| CVE-2026-103489 | 1 Oct 2026 | CVSS 5.4 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | |
| CVE-2026-103490 | 1 Oct 2026 | CVSS 7.2 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | |
| CVE-2026-103491 | 1 Oct 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues | |
| CVE-2026-103492 | 1 Oct 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments | |
| CVE-2026-103493 | 1 Oct 2026 | CVSS 8.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible | |
| CVE-2026-103494 | 1 Oct 2026 | CVSS 6.6 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes | |
| CVE-2026-103488 | 1 Oct 2026 | CVSS 7.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted… | |
| CVE-2026-100275 | 30 Sep 2026 | CVSS 4.8 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible | |
| CVE-2026-100276 | 30 Sep 2026 | CVSS 7.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action | |
| CVE-2026-100277 | 30 Sep 2026 | CVSS 9.8 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature | |
| CVE-2026-100278 | 30 Sep 2026 | CVSS 4.9 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments | |
| CVE-2026-100279 | 30 Sep 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials | |
| CVE-2026-100280 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible | |
| CVE-2026-100268 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates | |
| CVE-2026-100269 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed | |
| CVE-2026-100270 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations | |
| CVE-2026-100271 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other… | |
| CVE-2026-100272 | 30 Sep 2026 | CVSS 4.9 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read… | |
| CVE-2026-100273 | 30 Sep 2026 | CVSS 9.8 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution | |
| CVE-2026-100274 | 30 Sep 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template | |
| CVE-2026-100262 | 30 Sep 2026 | CVSS 7.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification… | |
| CVE-2026-100263 | 30 Sep 2026 | CVSS 6.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible | |
| CVE-2026-100264 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host | |
| CVE-2026-100265 | 30 Sep 2026 | CVSS 6.5 | JetBrains RiderIn JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation | |
| CVE-2026-100266 | 30 Sep 2026 | CVSS 6.5 | JetBrains HubIn JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address | |
| CVE-2026-100267 | 30 Sep 2026 | CVSS 5.9 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters | |
| CVE-2026-100255 | 30 Sep 2026 | CVSS 9.8 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset | |
| CVE-2026-100256 | 30 Sep 2026 | CVSS 7.8 | JetBrains IntelliJ IDEAIn JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects | |
| CVE-2026-100257 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export | |
| CVE-2026-100258 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings | |
| CVE-2026-100259 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access | |
| CVE-2026-100260 | 30 Sep 2026 | CVSS 5.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset | |
| CVE-2026-100261 | 30 Sep 2026 | CVSS 5.4 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission | |
| CVE-2026-100253 | 30 Sep 2026 | CVSS 8.8 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL | |
| CVE-2026-100254 | 30 Sep 2026 | CVSS 8.8 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline… | |
| CVE-2026-63077 | 27 Jul 2026 | CVSS 9.8 | JetBrains TeamCity Deserialization of Untrusted DataIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | Exploited |
| CVE-2024-27198 | 4 Mar 2024 | CVSS 9.8 | JetBrains TeamCity Authentication BypassIn JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible | Exploited |
| CVE-2024-27199 | 4 Mar 2024 | CVSS 7.3 | JetBrains TeamCity Relative Path TraversalIn JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible | Exploited |
| CVE-2023-42793 | 19 Sep 2023 | CVSS 9.8 | JetBrains TeamCity Authentication BypassIn JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible | Exploited |