Threat database

In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles

In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings

In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions

In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab

In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions

In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

CVE-2026-123323 is a high severity vulnerability in JetBrains YouTrack before version 2025.3.170763. It involves improper URL validation in the app widget host, which allowed apps to send REST requests without requiring user confirmation. This missing authorization flaw could lead to unauthorized actions with high impact on confidentiality, integrity, and availability.

CVE-2026-123322 is a vulnerability in JetBrains WebStorm before version 2026.3 that allows code execution in untrusted projects via the Angular CLI schematics loader. This flaw is due to inclusion of functionality from an untrusted control sphere (CWE-829). The vulnerability has a CVSS v3.1 score of 6.3, indicating a medium severity impact. It was fixed in version 2026.3.

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

CVE-2026-123320 is a vulnerability in JetBrains Toolbox App versions before 3.9 where the login dialog provides insufficient warning when connecting to potentially malicious servers. This could lead users to unknowingly connect to dangerous servers due to inadequate UI warnings.

A vulnerability in JetBrains Ktor before version 3.6.1 allows cookie injection due to missing validation of the Domain attribute in client cookie storage. This flaw is identified as CWE-565, which involves reliance on cookies without proper validation and integrity checking. The issue was fixed in version 3.6.1.

JetBrains Ktor versions before 3.6.1 contain an HTTP request smuggling vulnerability in the CIO engine. This flaw allows an attacker to interfere with the processing of HTTP requests, potentially leading to information disclosure and integrity issues. The vulnerability is fixed in version 3.6.1.

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs

CVE-2026-123315 is a vulnerability in JetBrains Junie CLI versions before 26.8.24. It involves a permissive regular expression related to the 'Allow Similar Commands' option, which allowed command execution. The issue is fixed in version 26.8.24.

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request

CVE-2026-123313 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.3 where improper checks could allow disabled plugins to be enabled via external dependency settings. This flaw relates to the inclusion of functionality from an untrusted control sphere, classified under CWE-829. The issue has a low CVSS score of 3.3 and does not impact confidentiality or availability but can cause limited integrity issues. The vulnerability is fixed in version 2026.3.

CVE-2026-123312 is a low-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It involves improper control of Document Type Definition (CWE-827) that allows SSRF (Server-Side Request Forgery) via annotations.xml files during the indexing process. The issue is fixed in version 2026.3.