In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

jetbrains

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

jetbrains

In JetBrains Junie before 252.549.29 command execution was possible via malicious project file

jetbrains

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

jetbrains

In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings

jetbrains

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

jetbrains

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk

jetbrains

In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations

jetbrains

In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow

jetbrains

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

jetbrains