Threat database

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

CVE-2026-49385 is a medium severity vulnerability in JetBrains YouTrack before version 2026.1.13570. It involves improper access control (CWE-862) that allows low-privileged users to modify service accounts. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a network attack vector with low complexity and no user interaction required. There is no confirmed patch or official remediation information available at this time. No known exploits are reported in the wild.

A stored cross-site scripting (XSS) vulnerability exists in JetBrains PyCharm versions before 2025.3.4, specifically affecting Jupyter notebook Markdown cells. This vulnerability allows an attacker to inject malicious scripts that could execute in the context of the affected application. The vulnerability is tracked as CVE-2026-49384 and has a CVSS v3.1 base score of 6.1, indicating a medium severity level. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

CVE-2026-49383 is a low-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.1. It involves an XML External Entity (XXE) issue in the UI Designer form parser, which could allow limited information disclosure. The vulnerability requires local access and user interaction to exploit and does not impact integrity or availability.