Threat database

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible

CVE-2026-75058 is a medium severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.1. It involves an XML External Entity (XXE) issue in the Eclipse settings importers component, which could allow an attacker to read arbitrary files. The vulnerability requires local access with low privileges and user interaction to exploit. No known exploits are reported in the wild, and no official patch information is provided in the available data.

JetBrains IntelliJ IDEA versions before 2026.1.5 contain a vulnerability where git credentials are written in plaintext to IDE log files. This exposure allows local attackers with access to these log files to obtain sensitive credential information. The vulnerability has a medium severity with a CVSS score of 6.2.

CVE-2026-75056 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.1. It involves a remote code execution (rCE) flaw via the Markdown export tool. The vulnerability is classified under CWE-78, which relates to OS command injection. The CVSS 3.1 base score is 7.8, indicating a high impact on confidentiality, integrity, and availability. No official patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.

CVE-2026-75055 is a medium severity XML External Entity (XXE) vulnerability in JetBrains IntelliJ IDEA before version 2026.2.1. It affects the Hadoop ResourceManager component and allows an attacker to read local files, impacting confidentiality. The vulnerability does not affect system integrity or availability. No official patch or remediation guidance has been confirmed yet.

CVE-2026-75054 is a Server-Side Request Forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA versions before 2026.2.1. It occurs via the OpenAPI preview proxy when working with untrusted projects. The vulnerability has a CVSS 3.1 score of 6.3, indicating medium severity. It allows an attacker with local access and user interaction to cause a server-side request that can lead to high confidentiality impact without affecting integrity or availability.

CVE-2026-75053 is a medium severity Server-Side Request Forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA versions before 2026.2.1. It affects the DevKit debug listener endpoint and could allow an attacker to cause the application to make unintended network requests. There is no official patch or remediation guidance available from the vendor at this time, and no exploitation has been reported in the wild.

CVE-2026-75052 is a low-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.1. It allows command execution via crafted Markdown preview content in trusted projects. The vulnerability requires local access with high attack complexity and user interaction. It impacts confidentiality and integrity with no impact on availability.

CVE-2026-75051 is a high-severity vulnerability in JetBrains YouTrack versions prior to 2026.2.17917 that allows unauthorized project transfers between organizations. This issue is classified under CWE-862, indicating improper authorization. The vulnerability has a CVSS 3.1 score of 8.1, reflecting high impact on confidentiality and integrity without affecting availability. No official patch or remediation details are provided in the input data. There are no known exploits in the wild at this time.

CVE-2026-75050 is a denial of service (DoS) vulnerability in JetBrains YouTrack that affects versions prior to 2026.1.13901 and 2026.2.17950. The vulnerability can be triggered by crafted type parameters, causing a DoS condition. It requires low privileges to exploit and does not require user interaction. The vulnerability has a high severity score of 7.1 (CVSS 3.1).

CVE-2026-75049 is a medium severity vulnerability in JetBrains YouTrack that allows an authenticated user to read restricted articles from other projects via the draft creation endpoint. It is classified as a missing authorization issue (CWE-862). This affects versions before 2026.1.13903 and 2026.2.17950. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

A stored cross-site scripting (XSS) vulnerability (CWE-79) exists in JetBrains YouTrack versions before 2026.2.18068. It results from improper sanitization of the fenced code-block language label, enabling attackers to inject malicious scripts that execute in other users' contexts. The vulnerability has a high severity with a CVSS score of 8.2. No patch or remediation details are currently provided, and no known exploits are reported in the wild.

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

A critical code execution vulnerability (CWE-94) exists in JetBrains TeamCity versions prior to 2026.1.2 and 2025.11.6. This vulnerability affects Git VCS roots and allows for remote code execution. The CVSS score is 9.1, indicating a high severity with significant impact on confidentiality, integrity, and availability.