jetbrains

43 records · 0 with a public proof-of-concept

Disclosed vulnerabilities where the NVD names jetbrains as an affected vendor, highest CVSS first.

  1. HIGH 8.9CVE-2026-1002772026-09-30

    In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

    youtrack

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.8CVE-2026-1062182026-10-06

    In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

    teamcity

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.8CVE-2026-1002542026-09-30

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

    teamcity

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.8CVE-2026-1002532026-09-30

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL

    teamcity

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 8.2CVE-2026-1002732026-09-30

    In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

    youtrack

    AI risk analysis on Exploit-DB.ai →

  6. HIGH 8.1CVE-2026-1110942026-10-15

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

    teamcity

    AI risk analysis on Exploit-DB.ai →

  7. HIGH 8.1CVE-2026-1034932026-10-01

    In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

    youtrack

    AI risk analysis on Exploit-DB.ai →

  8. HIGH 8.1CVE-2026-1002552026-09-30

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

    teamcity

    AI risk analysis on Exploit-DB.ai →

  9. HIGH 8CVE-2026-1110952026-10-15

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible

    teamcity

    AI risk analysis on Exploit-DB.ai →

  10. HIGH 7.8CVE-2026-1002562026-09-30

    In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

    intellij idea

    AI risk analysis on Exploit-DB.ai →

  11. HIGH 7.7CVE-2026-1002682026-09-30

    In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

    youtrack

    AI risk analysis on Exploit-DB.ai →

  12. HIGH 7.7CVE-2026-1002662026-09-30

    In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

    hub

    AI risk analysis on Exploit-DB.ai →

  13. HIGH 7.6CVE-2026-1002622026-09-30

    In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

    youtrack

    AI risk analysis on Exploit-DB.ai →

  14. HIGH 7.2CVE-2026-1034902026-10-01

    In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

    youtrack

    AI risk analysis on Exploit-DB.ai →

  15. HIGH 7.1CVE-2026-1034882026-10-01

    In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

    youtrack

    AI risk analysis on Exploit-DB.ai →

  16. MEDIUM 6.9CVE-2026-1002752026-09-30

    In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

    youtrack

    AI risk analysis on Exploit-DB.ai →

  17. MEDIUM 6.7CVE-2026-1110962026-10-15

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible

    teamcity

    AI risk analysis on Exploit-DB.ai →

  18. MEDIUM 6.6CVE-2026-1034942026-10-01

    In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

    youtrack

    AI risk analysis on Exploit-DB.ai →

  19. MEDIUM 6.5CVE-2026-1062192026-10-06

    In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

    teamcity

    AI risk analysis on Exploit-DB.ai →

  20. MEDIUM 6.5CVE-2026-1034922026-10-01

    In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

    youtrack

    AI risk analysis on Exploit-DB.ai →

  21. MEDIUM 6.5CVE-2026-1034912026-10-01

    In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

    youtrack

    AI risk analysis on Exploit-DB.ai →

  22. MEDIUM 6.5CVE-2026-1002792026-09-30

    In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

    youtrack

    AI risk analysis on Exploit-DB.ai →

  23. MEDIUM 6.5CVE-2026-1002742026-09-30

    In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

    youtrack

    AI risk analysis on Exploit-DB.ai →

  24. MEDIUM 5.9CVE-2026-1002762026-09-30

    In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

    youtrack

    AI risk analysis on Exploit-DB.ai →

  25. MEDIUM 5.9CVE-2026-1002672026-09-30

    In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

    youtrack

    AI risk analysis on Exploit-DB.ai →

  26. MEDIUM 5.5CVE-2026-1034972026-10-01

    In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

    youtrack

    AI risk analysis on Exploit-DB.ai →

  27. MEDIUM 5.4CVE-2026-1034962026-10-01

    In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

    youtrack

    AI risk analysis on Exploit-DB.ai →

  28. MEDIUM 5.4CVE-2026-1002612026-09-30

    In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

    youtrack

    AI risk analysis on Exploit-DB.ai →

  29. MEDIUM 5.3CVE-2026-1002602026-09-30

    In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

    youtrack

    AI risk analysis on Exploit-DB.ai →

  30. MEDIUM 4.9CVE-2026-1002782026-09-30

    In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

    youtrack

    AI risk analysis on Exploit-DB.ai →

  31. MEDIUM 4.9CVE-2026-1002722026-09-30

    In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

    youtrack

    AI risk analysis on Exploit-DB.ai →

  32. MEDIUM 4.8CVE-2026-1002652026-09-30

    In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

    rider

    AI risk analysis on Exploit-DB.ai →

  33. MEDIUM 4.7CVE-2026-1002632026-09-30

    In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

    youtrack

    AI risk analysis on Exploit-DB.ai →

  34. MEDIUM 4.3CVE-2026-1034952026-10-01

    In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

    youtrack

    AI risk analysis on Exploit-DB.ai →

  35. MEDIUM 4.3CVE-2026-1002692026-09-30

    In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

    youtrack

    AI risk analysis on Exploit-DB.ai →

  36. MEDIUM 4.3CVE-2026-1002592026-09-30

    In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

    youtrack

    AI risk analysis on Exploit-DB.ai →

  37. MEDIUM 4.3CVE-2026-1002582026-09-30

    In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

    youtrack

    AI risk analysis on Exploit-DB.ai →

  38. MEDIUM 4.3CVE-2026-1002572026-09-30

    In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

    youtrack

    AI risk analysis on Exploit-DB.ai →

  39. LOW 3.3CVE-2026-1002702026-09-30

    In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

    youtrack

    AI risk analysis on Exploit-DB.ai →

  40. LOW 3.1CVE-2026-1002802026-09-30

    In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

    youtrack

    AI risk analysis on Exploit-DB.ai →

  41. LOW 2.7CVE-2026-1002712026-09-30

    In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

    youtrack

    AI risk analysis on Exploit-DB.ai →

  42. LOW 2.7CVE-2026-1002642026-09-30

    In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

    youtrack

    AI risk analysis on Exploit-DB.ai →

  43. LOW 2CVE-2026-1034892026-10-01

    In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

    youtrack

    AI risk analysis on Exploit-DB.ai →