jetbrains CVEs

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to account…

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to adminis…

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests