In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

jetbrains

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

jetbrains

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

jetbrains

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

jetbrains

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

jetbrains

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

jetbrains

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

jetbrains

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

jetbrains

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

jetbrains

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

jetbrains

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

jetbrains

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK

jetbrains

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration

jetbrains

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default

jetbrains

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open

jetbrains

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible