JetBrains

Latest CVEs · RSS

• CVE-2026-111096 2026-10-15 · CVSS 6.7
  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
• CVE-2026-111095 2026-10-15 · CVSS 8.0
  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
• CVE-2026-111094 2026-10-15 · CVSS 8.1
  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
• CVE-2026-111093 2026-10-15 · CVSS 7.5
  In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
• CVE-2026-111092 2026-10-15 · CVSS 6.5
  In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
• CVE-2026-111091 2026-10-15 · CVSS 7.8
  In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
• CVE-2026-108474 2026-10-09 · CVSS 9.8
  In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
• CVE-2026-106219 2026-10-06 · CVSS 6.5
  In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
• CVE-2026-106218 2026-10-06 · CVSS 8.8
  In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
• CVE-2026-103497 2026-10-01 · CVSS 5.5
  In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
• CVE-2026-103496 2026-10-01 · CVSS 5.4
  In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
• CVE-2026-103495 2026-10-01 · CVSS 4.3
  In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
• CVE-2026-103494 2026-10-01 · CVSS 6.6
  In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
• CVE-2026-103493 2026-10-01 · CVSS 8.1
  In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
• CVE-2026-103492 2026-10-01 · CVSS 6.5
  In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
• CVE-2026-103491 2026-10-01 · CVSS 6.5
  In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
• CVE-2026-103490 2026-10-01 · CVSS 7.2
  In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
• CVE-2026-103489 2026-10-01 · CVSS 2.0
  In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
• CVE-2026-103488 2026-10-01 · CVSS 7.1
  In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
• CVE-2026-100280 2026-09-30 · CVSS 3.1
  In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
• CVE-2026-100279 2026-09-30 · CVSS 6.5
  In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
• CVE-2026-100278 2026-09-30 · CVSS 4.9
  In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
• CVE-2026-100277 2026-09-30 · CVSS 8.9
  In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
• CVE-2026-100276 2026-09-30 · CVSS 5.9
  In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
• CVE-2026-100275 2026-09-30 · CVSS 6.9
  In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible