Threat database

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

CVE-2026-100256 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.3. It allows remote code execution (rCE) via Structural Search script constraints when working with untrusted projects. The vulnerability is identified as CWE-829, which relates to inclusion of functionality from untrusted control spheres. No official patch information is provided in the input data.

A vulnerability in JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 allows an attacker to take over administrator accounts via the password reset functionality. This issue is tracked as CVE-2026-100255 and is associated with CWE-1289. The vulnerability has a high severity rating with a CVSS 3.1 score of 8.1.

CVE-2026-100254 is a command injection vulnerability in JetBrains TeamCity affecting versions before 2026.2, 2026.1.4, and 2025.11.8. Authenticated users can exploit CRLF injection in Pipeline Git connection settings to execute arbitrary commands on Windows servers. The vulnerability has a high severity with a CVSS score of 8.8.

CVE-2026-100253 is a high-severity vulnerability in JetBrains TeamCity that allows sandbox escape and code execution via the versioned settings Kotlin DSL. It affects versions before 2026.2, including 2026.1.4 and 2025.11.8. The vulnerability is identified as CWE-184 and has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability.

JetBrains GoLand versions before 2026.2.2.1 contain a vulnerability where the GoLand profiler's injected pprof server lacks authentication, exposing profiling data. This vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). It has a medium severity with a CVSS score of 5.9. No official patch or remediation details are provided in the input data.

CVE-2026-86505 is a low-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.2 where a missing project-trust check caused leakage of project metadata to JetBrains Marketplace. This issue does not allow unauthorized modification or denial of service but may expose some project information. The vulnerability has a CVSS score of 3.3 and requires user interaction with low privileges. No known exploits are reported in the wild. A fix is implied by the versioning but no explicit patch link is provided.

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

CVE-2026-86503 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.2.2 where opening an untrusted project could trigger a Server-Side Request Forgery (SSRF) via Kubernetes spec-source URL fetching. The vulnerability has a low severity with a CVSS score of 3.3. It requires user interaction and local access to exploit. No known exploits are reported in the wild. The affected versions are all versions prior to 2026.2.2.

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

CVE-2026-86501 is a low-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.2 where terminal command inputs could be written to the idea.log file. This issue is categorized under CWE-532, which involves exposure of information through log files. The vulnerability does not impact integrity or availability and requires local privileges with user interaction to exploit.

CVE-2026-86500 is a vulnerability in JetBrains YouTrack before version 2026.1.14047 where a missing escalation check allows a user with project update permissions to elevate their privileges to Project Admin. This flaw is categorized under CWE-266 (Incorrect Privilege Assignment). The vulnerability has a medium severity with a CVSS score of 5.5.