Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
308 results · Clear filters · Feed
-
Medium 6.5
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on th…
-
Medium 5.5
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
-
Medium 6.6
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
-
Medium 6.9
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
-
Medium 5.9
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run t…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Ad…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
-
Medium 5.9
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
-
Medium 4.8
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
-
Medium 4.7
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
-
Medium 5.4
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only …
-
Medium 5.3
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
-
Medium 5.9
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed pro…
-
Medium 5.5
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant t…
-
Medium 4.3
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of vi…
-
Medium 6.8
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administr…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inacces…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter emai…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify white…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app im…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders …
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved s…
-
Medium 4.6
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
-
Medium 5.4
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
-
Medium 4.4
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
-
Medium 5.5
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
-
Medium 6.2
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
-
Medium 5.5
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
-
Medium 6.3
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects