CVE-2026-49382 is a medium severity vulnerability in JetBrains IntelliJ IDEA before version 2026.1. It involves code execution via template injection in the Copyright plugin. The vulnerability has a CVSS 3.1 base score of 4.5, indicating limited impact with high attack complexity and required user interaction. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-49381 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity versions before 2026.1. The vulnerability exists on the SAML login page, allowing an attacker with high privileges to inject malicious scripts that are stored and later executed in the context of users accessing that page. The CVSS score is 3.4, indicating a low severity impact primarily affecting confidentiality with no direct impact on integrity or availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.
CVE-2026-49380 is an open redirect vulnerability (CWE-601) in the SAML plugin of JetBrains TeamCity versions before 2026.1. The vulnerability allows an attacker to craft a URL that redirects users to an unintended external site. The CVSS score is 3.1, indicating a low severity issue with limited impact. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-49379 is a medium severity vulnerability in JetBrains TeamCity versions before 2026.1 where credentials could be exposed in thread names. This exposure could allow an attacker with network access and low privileges to obtain sensitive credential information. The vulnerability does not impact integrity or availability but has high confidentiality impact. No official patch or remediation guidance has been provided yet by the vendor.
CVE-2026-49378 is a medium severity vulnerability in JetBrains TeamCity before version 2026.1 where credential parameters were exposed through parameter autocompletion. This exposure could allow users with limited privileges to see sensitive credential information unintentionally. The vulnerability is classified under CWE-862 (Missing Authorization). There is no official patch or remediation level confirmed yet, and no known exploits in the wild have been reported. The CVSS score is 4.3, indicating a low to medium impact primarily affecting confidentiality without impacting integrity or availability.
CVE-2026-49377 is a medium severity vulnerability in JetBrains TeamCity before version 2025.11.2. It involves the exposure of sensitive data through default agent parameters. The vulnerability is identified as CWE-526, which relates to exposure of sensitive information. There is no official patch or remediation level provided yet, and no known exploits in the wild have been reported. The CVSS score is 4.3, indicating a medium impact primarily due to confidentiality loss without impact on integrity or availability.
CVE-2026-49376 is a medium severity vulnerability in JetBrains TeamCity prior to version 2026.1 involving insufficient username validation in the SAML plugin. This weakness corresponds to CWE-863, which relates to improper authorization. The vulnerability could allow unauthorized access or actions due to inadequate validation of usernames during SAML authentication. No official patch or remediation level has been confirmed yet, and there are no known exploits in the wild at this time.
CVE-2026-49375 is a reflected cross-site scripting (XSS) vulnerability in JetBrains TeamCity versions before 2026.1. The issue occurs on the repository download page, allowing an attacker to inject malicious scripts that could be executed in the context of a user's browser session. The vulnerability has a CVSS score of 6.1, indicating a medium severity level. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.
CVE-2026-49374 is a high-severity vulnerability in JetBrains TeamCity prior to version 2026.1. It involves improper permission checks that allow unauthorized exposure of build configuration parameters. The vulnerability is classified under CWE-862 (Improper Authorization). There is no vendor-provided patch or official remediation guidance available at this time. The CVSS 3.1 base score is 7.6, indicating a significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users of affected versions should monitor vendor advisories for updates.
CVE-2026-49373 is a high-severity vulnerability in JetBrains TeamCity before version 2026.1 that allows remote code execution via Perforce connection settings. The vulnerability is classified under CWE-88, which relates to improper neutralization of commands or arguments. There is no official patch or remediation level currently confirmed, and no known exploits in the wild have been reported. The vulnerability requires at least low privileges and no user interaction to exploit, with a high impact on confidentiality but limited impact on integrity and no impact on availability.
CVE-2026-49372 is a high-severity vulnerability in JetBrains TeamCity versions before 2026.1 and 2025.11.5, allowing unauthenticated Server-Side Request Forgery (SSRF) via the build status feature. This vulnerability enables an attacker to make the server perform unauthorized requests, potentially leading to information disclosure. The vulnerability is identified as CWE-918. No official patch or remediation guidance has been provided yet by JetBrains. There are no known exploits in the wild at this time.
A reflected cross-site scripting (XSS) vulnerability exists in JetBrains TeamCity versions before 2026.1.1 in the keyword filter functionality. This vulnerability allows an attacker to inject malicious scripts that can be executed in the context of a user's browser session. The vulnerability has a high severity score of 7.1 according to CVSS 3.1. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.
CVE-2026-49370 is a low-severity information disclosure vulnerability in JetBrains YouTrack versions before 2026.1.13162. It involves the exposure of information through fetchApp requests. The vulnerability has a CVSS score of 3.4, indicating limited impact. There is no confirmed patch or official remediation guidance available at this time. No known exploits are reported in the wild. The vulnerability requires high privileges and user interaction to be exploited.
CVE-2026-49369 is a medium severity vulnerability in JetBrains YouTrack versions before 2026.1.13162 that allows information disclosure on the Users and Groups pages. The issue is classified under CWE-863, which relates to improper authorization. The vulnerability does not require user interaction and can be exploited remotely with low complexity, but requires some level of privileges. There is no official patch or remediation level confirmed yet. No known exploits are reported in the wild. The impact is limited to confidentiality loss without affecting integrity or availability.
CVE-2026-49368 is a high-severity stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack versions before 2026.1.13162. The vulnerability allows an attacker with limited privileges to inject malicious scripts into project notification templates, which can be executed in the context of other users. This can lead to complete compromise of confidentiality and integrity of affected users' data. No official patch or remediation guidance is currently confirmed from the vendor. There are no known exploits in the wild at this time.
CVE-2026-49367 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.1.1 that allows command execution via the guest user account. The vulnerability is classified under CWE-862, indicating an authorization bypass issue. The CVSS 3.1 base score is 8.0, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.
CVE-2026-49366 is a high-severity command injection vulnerability in JetBrains IntelliJ IDEA versions before 2026.1.1. The issue arises from unsafe handling of filename completion, allowing an attacker with local access and user interaction to execute arbitrary commands. This vulnerability impacts confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance has been confirmed yet from the vendor. There are no known exploits in the wild at this time.
In JetBrains IntelliJ IDEA before 2024.3.7.1,
2025.1.7.1,
2025.2.6.2,
2025.3.4.1,
2026.1.1 reading arbitrary local files was possible via built-in web server