Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
88 results · Clear filters · Feed
-
Low 3.5
In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
-
Low 3.6
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
-
Low 3.1
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
-
Low 3.8
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by an…
-
Low 3.5
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to …
-
Low 3.1
In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
-
Low 3.8
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between spri…
-
Low 3.7
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
-
Low 3.1
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
-
Low 3.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
-
Low 3.1
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
-
Low 2.7
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module gr…
-
Low 2.7
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
-
Low 2.0
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
-
Low 3.1
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
-
Low 2.7
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to acc…
-
Low 3.3
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials …
-
Low 2.7
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source U…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
-
Low 2.8
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
-
Low 3.5
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
-
Low 3.1
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canv…
-
Low 3.5
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
-
Low 3.7
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
-
Low 3.6
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trust…
-
Low 3.5
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
-
Low 3.5
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
-
Low 3.5
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
-
Low 2.6
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
-
Low 3.1
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
-
Low 3.1
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
-
Low 3.4
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
-
Low 3.4
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
-
Low 2.3
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk