Jetbrains
jetbrains
582 CVEs • 38 products
Products (38)
Click to collapseToggle
Products (38)
Click to collapse
CVEs (582)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible |
In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks |
In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible |
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data |
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration |
In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible |
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible |
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack |
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags |
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details |
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings |
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible |
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint |
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata |
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 privilege escalation by attaching authentication details to accounts was possible |
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 account takeover via predictable restore codes was possible |
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration |
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible |
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas |
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts |