CVE-2026-111091 HIGH 7.8 Junie Cli — In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configu… 2026-10-15 CVE-2026-111092 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project … 2026-10-15 CVE-2026-111093 HIGH 7.5 Datalore — In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed read… 2026-10-15 CVE-2026-111094 HIGH 8.1 Teamcity — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the… 2026-10-15 CVE-2026-111095 HIGH 8 Teamcity — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was poss… 2026-10-15 CVE-2026-111096 MEDIUM 6.7 Teamcity — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible 2026-10-15 CVE-2026-108474 CRITICAL 9.8 Exposed — In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL fun… 2026-10-09 CVE-2026-106218 HIGH 8.8 Teamcity — In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was pos… 2026-10-06 CVE-2026-106219 MEDIUM 6.5 Teamcity — In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositor… 2026-10-06 CVE-2026-103488 HIGH 7.1 Youtrack — In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves … 2026-10-01 CVE-2026-103489 LOW 2 Youtrack — In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible 2026-10-01 CVE-2026-103490 HIGH 7.2 Youtrack — In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links 2026-10-01 CVE-2026-103491 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues 2026-10-01 CVE-2026-103492 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments 2026-10-01 CVE-2026-103493 HIGH 8.1 Youtrack — In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible 2026-10-01 CVE-2026-103494 MEDIUM 6.6 Youtrack — In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes 2026-10-01 CVE-2026-103495 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs 2026-10-01 CVE-2026-103496 MEDIUM 5.4 Youtrack — In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications 2026-10-01 CVE-2026-103497 MEDIUM 5.5 Youtrack — In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration 2026-10-01 CVE-2026-100253 HIGH 8.8 Teamcity — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possib… 2026-09-30 CVE-2026-100254 HIGH 8.8 Teamcity — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windo… 2026-09-30 CVE-2026-100255 HIGH 8.1 Teamcity — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via pas… 2026-09-30 CVE-2026-100256 HIGH 7.8 Intellij Idea — In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrus… 2026-09-30 CVE-2026-100257 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export 2026-09-30 CVE-2026-100258 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settin… 2026-09-30 CVE-2026-100259 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with v… 2026-09-30 CVE-2026-100260 MEDIUM 5.3 Youtrack — In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset 2026-09-30 CVE-2026-100261 MEDIUM 5.4 Youtrack — In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update per… 2026-09-30 CVE-2026-100262 HIGH 7.6 Youtrack — In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to… 2026-09-30 CVE-2026-100263 MEDIUM 4.7 Youtrack — In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible 2026-09-30 CVE-2026-100264 LOW 2.7 Youtrack — In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the se… 2026-09-30 CVE-2026-100265 MEDIUM 4.8 Rider — In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation 2026-09-30 CVE-2026-100266 HIGH 7.7 Hub — In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary email… 2026-09-30 CVE-2026-100267 MEDIUM 5.9 Youtrack — In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters 2026-09-30 CVE-2026-100268 HIGH 7.7 Youtrack — In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via n… 2026-09-30 CVE-2026-100269 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed 2026-09-30 CVE-2026-100270 LOW 3.3 Youtrack — In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration cre… 2026-09-30 CVE-2026-100271 LOW 2.7 Youtrack — In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated use… 2026-09-30 CVE-2026-100272 MEDIUM 4.9 Youtrack — In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed P… 2026-09-30 CVE-2026-100273 HIGH 8.2 Youtrack — In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code … 2026-09-30 CVE-2026-100274 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template 2026-09-30 CVE-2026-100275 MEDIUM 6.9 Youtrack — In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible 2026-09-30 CVE-2026-100276 MEDIUM 5.9 Youtrack — In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction … 2026-09-30 CVE-2026-100277 HIGH 8.9 Youtrack — In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature 2026-09-30 CVE-2026-100278 MEDIUM 4.9 Youtrack — In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' co… 2026-09-30 CVE-2026-100279 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials 2026-09-30 CVE-2026-100280 LOW 3.1 Youtrack — In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible 2026-09-30 CVE-2026-86478 CRITICAL 9.8 Youtrack — In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed… 2026-09-07 CVE-2026-86479 HIGH 8 Youtrack — In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access … 2026-09-07 CVE-2026-86480 CRITICAL 9.8 Hub — In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain sup… 2026-09-07 CVE-2026-86481 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons 2026-09-07 CVE-2026-86482 HIGH 8.8 Youtrack — In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escal… 2026-09-07 CVE-2026-86483 MEDIUM 5.4 Youtrack — In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible 2026-09-07 CVE-2026-86484 MEDIUM 4.6 Youtrack — In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS 2026-09-07 CVE-2026-86485 LOW 3.5 Youtrack — In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks 2026-09-07 CVE-2026-86486 LOW 3.7 Youtrack — In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blan… 2026-09-07 CVE-2026-86487 LOW 3.1 Youtrack — In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to mo… 2026-09-07 CVE-2026-86488 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed privat… 2026-09-07 CVE-2026-86489 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred… 2026-09-07 CVE-2026-86490 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via t… 2026-09-07 CVE-2026-86491 LOW 3.5 Youtrack — In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads 2026-09-07 CVE-2026-86492 HIGH 8.5 Youtrack — In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App instal… 2026-09-07 CVE-2026-86493 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and mod… 2026-09-07 CVE-2026-86494 HIGH 7.7 Youtrack — In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inacce… 2026-09-07 CVE-2026-86495 MEDIUM 6.5 Youtrack — In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles i… 2026-09-07 CVE-2026-86496 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed repo… 2026-09-07 CVE-2026-86497 MEDIUM 6.8 Youtrack — In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project … 2026-09-07 CVE-2026-86498 HIGH 7.7 Youtrack — In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modificat… 2026-09-07 CVE-2026-86499 MEDIUM 4.3 Youtrack — In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardl… 2026-09-07 CVE-2026-86500 MEDIUM 5.5 Youtrack — In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permission… 2026-09-07 CVE-2026-86501 LOW 2.8 Intellij Idea — In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log 2026-09-07 CVE-2026-86502 HIGH 8.4 Intellij Idea — In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed loc… 2026-09-07 CVE-2026-86503 LOW 3.3 Intellij Idea — In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec… 2026-09-07 CVE-2026-86504 HIGH 7.8 Intellij Idea — In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container … 2026-09-07 CVE-2026-86505 LOW 3.3 Intellij Idea — In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Ma… 2026-09-07 CVE-2026-86506 MEDIUM 5.9 Goland — In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server ex… 2026-09-07