https://vulnogram.org/ Most recent CVEs assigned by JetBrains s.r.o. (jetbrains). https://vulnogram.org/seaview/icons/jetbrains.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-111096 https://vulnogram.org/CVE-2026-111096 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible Medium Thu, 15 Oct 2026 15:29:54 GMT https://vulnogram.org/CVE-2026-111095 https://vulnogram.org/CVE-2026-111095 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible High Thu, 15 Oct 2026 15:29:54 GMT https://vulnogram.org/CVE-2026-111094 https://vulnogram.org/CVE-2026-111094 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible High Network Exploitable Thu, 15 Oct 2026 15:29:53 GMT https://vulnogram.org/CVE-2026-111093 https://vulnogram.org/CVE-2026-111093 In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files High Network Exploitable Thu, 15 Oct 2026 15:29:53 GMT https://vulnogram.org/CVE-2026-111092 https://vulnogram.org/CVE-2026-111092 In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands Medium Thu, 15 Oct 2026 15:29:52 GMT https://vulnogram.org/CVE-2026-111091 https://vulnogram.org/CVE-2026-111091 In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration High Thu, 15 Oct 2026 15:29:52 GMT https://vulnogram.org/CVE-2026-108474 https://vulnogram.org/CVE-2026-108474 In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions Critical Network Exploitable Fri, 09 Oct 2026 23:13:49 GMT https://vulnogram.org/CVE-2026-106219 https://vulnogram.org/CVE-2026-106219 In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server Medium Tue, 06 Oct 2026 16:33:06 GMT https://vulnogram.org/CVE-2026-106218 https://vulnogram.org/CVE-2026-106218 In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible High Tue, 06 Oct 2026 16:33:06 GMT https://vulnogram.org/CVE-2026-103497 https://vulnogram.org/CVE-2026-103497 In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration Medium Thu, 01 Oct 2026 09:15:27 GMT https://vulnogram.org/CVE-2026-103496 https://vulnogram.org/CVE-2026-103496 In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications Medium Thu, 01 Oct 2026 09:15:27 GMT https://vulnogram.org/CVE-2026-103495 https://vulnogram.org/CVE-2026-103495 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs Medium Thu, 01 Oct 2026 09:15:26 GMT https://vulnogram.org/CVE-2026-103494 https://vulnogram.org/CVE-2026-103494 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes Medium Thu, 01 Oct 2026 09:15:26 GMT https://vulnogram.org/CVE-2026-103493 https://vulnogram.org/CVE-2026-103493 In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible High Network Exploitable Thu, 01 Oct 2026 09:15:26 GMT https://vulnogram.org/CVE-2026-103492 https://vulnogram.org/CVE-2026-103492 In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments Medium Thu, 01 Oct 2026 09:15:25 GMT https://vulnogram.org/CVE-2026-103491 https://vulnogram.org/CVE-2026-103491 In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues Medium Thu, 01 Oct 2026 09:15:24 GMT https://vulnogram.org/CVE-2026-103490 https://vulnogram.org/CVE-2026-103490 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links High Thu, 01 Oct 2026 09:15:24 GMT https://vulnogram.org/CVE-2026-103489 https://vulnogram.org/CVE-2026-103489 In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible Low Thu, 01 Oct 2026 09:15:23 GMT https://vulnogram.org/CVE-2026-103488 https://vulnogram.org/CVE-2026-103488 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues High Thu, 01 Oct 2026 09:15:23 GMT https://vulnogram.org/CVE-2026-100280 https://vulnogram.org/CVE-2026-100280 In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible Low Wed, 30 Sep 2026 15:17:56 GMT https://vulnogram.org/CVE-2026-100279 https://vulnogram.org/CVE-2026-100279 In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials Medium Wed, 30 Sep 2026 15:17:55 GMT https://vulnogram.org/CVE-2026-100278 https://vulnogram.org/CVE-2026-100278 In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments Medium Wed, 30 Sep 2026 15:17:55 GMT https://vulnogram.org/CVE-2026-100277 https://vulnogram.org/CVE-2026-100277 In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature High Network Exploitable Wed, 30 Sep 2026 15:17:55 GMT https://vulnogram.org/CVE-2026-100276 https://vulnogram.org/CVE-2026-100276 In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action Medium Network Exploitable Wed, 30 Sep 2026 15:17:54 GMT https://vulnogram.org/CVE-2026-100275 https://vulnogram.org/CVE-2026-100275 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible Medium Wed, 30 Sep 2026 15:17:54 GMT https://vulnogram.org/CVE-2026-100274 https://vulnogram.org/CVE-2026-100274 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template Medium Wed, 30 Sep 2026 15:17:53 GMT https://vulnogram.org/CVE-2026-100273 https://vulnogram.org/CVE-2026-100273 In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution High Wed, 30 Sep 2026 15:17:53 GMT https://vulnogram.org/CVE-2026-100272 https://vulnogram.org/CVE-2026-100272 In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues Medium Wed, 30 Sep 2026 15:17:52 GMT https://vulnogram.org/CVE-2026-100271 https://vulnogram.org/CVE-2026-100271 In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects Low Wed, 30 Sep 2026 15:17:52 GMT https://vulnogram.org/CVE-2026-100270 https://vulnogram.org/CVE-2026-100270 In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations Low Wed, 30 Sep 2026 15:17:52 GMT https://vulnogram.org/CVE-2026-100269 https://vulnogram.org/CVE-2026-100269 In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed Medium Wed, 30 Sep 2026 15:17:51 GMT https://vulnogram.org/CVE-2026-100268 https://vulnogram.org/CVE-2026-100268 In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates High Wed, 30 Sep 2026 15:17:51 GMT https://vulnogram.org/CVE-2026-100267 https://vulnogram.org/CVE-2026-100267 In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters Medium Network Exploitable Wed, 30 Sep 2026 15:17:51 GMT https://vulnogram.org/CVE-2026-100266 https://vulnogram.org/CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address High Wed, 30 Sep 2026 15:17:50 GMT https://vulnogram.org/CVE-2026-100265 https://vulnogram.org/CVE-2026-100265 In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation Medium Network Exploitable Wed, 30 Sep 2026 15:17:50 GMT https://vulnogram.org/CVE-2026-100264 https://vulnogram.org/CVE-2026-100264 In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host Low Wed, 30 Sep 2026 15:17:50 GMT https://vulnogram.org/CVE-2026-100263 https://vulnogram.org/CVE-2026-100263 In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible Medium Network Exploitable Wed, 30 Sep 2026 15:17:49 GMT https://vulnogram.org/CVE-2026-100262 https://vulnogram.org/CVE-2026-100262 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates High Wed, 30 Sep 2026 15:17:49 GMT https://vulnogram.org/CVE-2026-100261 https://vulnogram.org/CVE-2026-100261 In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission Medium Wed, 30 Sep 2026 15:17:48 GMT https://vulnogram.org/CVE-2026-100260 https://vulnogram.org/CVE-2026-100260 In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset Medium Network Exploitable Wed, 30 Sep 2026 15:17:48 GMT https://vulnogram.org/CVE-2026-100259 https://vulnogram.org/CVE-2026-100259 In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access Medium Wed, 30 Sep 2026 15:17:48 GMT https://vulnogram.org/CVE-2026-100258 https://vulnogram.org/CVE-2026-100258 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings Medium Wed, 30 Sep 2026 15:17:47 GMT https://vulnogram.org/CVE-2026-100257 https://vulnogram.org/CVE-2026-100257 In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export Medium Wed, 30 Sep 2026 15:17:46 GMT https://vulnogram.org/CVE-2026-100256 https://vulnogram.org/CVE-2026-100256 In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects High Wed, 30 Sep 2026 15:17:46 GMT https://vulnogram.org/CVE-2026-100255 https://vulnogram.org/CVE-2026-100255 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset High Network Exploitable Wed, 30 Sep 2026 15:17:46 GMT https://vulnogram.org/CVE-2026-100254 https://vulnogram.org/CVE-2026-100254 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings High Wed, 30 Sep 2026 15:17:45 GMT https://vulnogram.org/CVE-2026-100253 https://vulnogram.org/CVE-2026-100253 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL High Wed, 30 Sep 2026 15:17:44 GMT https://vulnogram.org/CVE-2026-86506 https://vulnogram.org/CVE-2026-86506 In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data Medium Network Exploitable Mon, 07 Sep 2026 16:26:51 GMT https://vulnogram.org/CVE-2026-86505 https://vulnogram.org/CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace Low Mon, 07 Sep 2026 16:26:50 GMT https://vulnogram.org/CVE-2026-86504 https://vulnogram.org/CVE-2026-86504 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution High Mon, 07 Sep 2026 16:26:50 GMT