Vulnerabilities in JetBrains
545 resultsCVE-2022-48481MEDIUMIn JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possibleEPSS 0.2%CVE-2025-54535MEDIUMIn JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsEPSS 0.2%CVE-2026-100257MEDIUMIn JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF exportEPSS 0.2%CVE-2026-49368HIGHIn JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possibleEPSS 0.2%CVE-2025-68268MEDIUMIn JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageEPSS 0.2%CVE-2026-49375MEDIUMIn JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download pageEPSS 0.2%CVE-2026-49369MEDIUMIn JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pagesEPSS 0.2%CVE-2026-123317HIGHIn JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookiesEPSS 0.2%CVE-2026-100269MEDIUMIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassedEPSS 0.2%CVE-2026-123848HIGHIn JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificatesEPSS 0.2%CVE-2026-123306HIGHIn JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsEPSS 0.2%CVE-2026-103491MEDIUMIn JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issuesEPSS 0.2%CVE-2025-64681LOWIn JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitationsEPSS 0.2%CVE-2022-46827LOWIn JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.EPSS 0.2%CVE-2025-42921MEDIUMIn JetBrains Toolbox App before 2.6 host key verification was missing in SSH pluginEPSS 0.2%CVE-2026-123840MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsEPSS 0.2%CVE-2025-68166MEDIUMIn JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tabEPSS 0.2%CVE-2026-32229MEDIUMIn JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabledEPSS 0.2%CVE-2026-123333LOWIn JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprintsEPSS 0.2%CVE-2022-37396MEDIUMIn JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code executionEPSS 0.2%