Vulnerabilities in JetBrains
545 resultsCVE-2024-24941MEDIUMIn JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URLEPSS 0.3%CVE-2022-48342MEDIUMIn JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.EPSS 0.3%CVE-2024-38506MEDIUMIn JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsEPSS 0.3%CVE-2024-56353MEDIUMIn JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookiesEPSS 0.3%CVE-2026-123279CRITICALIn JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaboratorsEPSS 0.3%CVE-2024-43807MEDIUMIn JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds pageEPSS 0.3%CVE-2024-47161MEDIUMIn JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST APIEPSS 0.3%CVE-2024-56351MEDIUMIn JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user rolesEPSS 0.3%CVE-2024-24936MEDIUMIn JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missedEPSS 0.3%CVE-2024-56354MEDIUMIn JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permissionEPSS 0.3%CVE-2026-100273HIGHIn JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code executionEPSS 0.3%CVE-2026-86493MEDIUMIn JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cardsEPSS 0.3%CVE-2026-86494HIGHIn JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issuesEPSS 0.3%CVE-2026-86498HIGHIn JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without upEPSS 0.3%CVE-2026-57921MEDIUMIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpointEPSS 0.3%CVE-2026-49372HIGHIn JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possibleEPSS 0.3%CVE-2026-123834HIGHIn JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service accountEPSS 0.3%CVE-2024-41824MEDIUMIn JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific casesEPSS 0.3%CVE-2024-41826LOWIn JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection pageEPSS 0.3%CVE-2025-24456MEDIUMIn JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mappingEPSS 0.3%