Threat database

CVE-2026-111096 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity affecting versions before 2026.2, 2026.1.4, and 2025.11.8. This vulnerability allows an attacker with limited privileges and user interaction to inject malicious scripts into the classic build log. The vulnerability has a medium severity with a CVSS score of 6.7.

CVE-2026-111095 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity affecting versions before 2026.2, including 2026.1.4 and 2025.11.8. The vulnerability exists in the classic project overview feature, allowing malicious scripts to be stored and potentially executed. It has a high severity with a CVSS score of 8.0. No explicit patch links are provided in the input data.

CVE-2026-111094 is a high-severity vulnerability in JetBrains TeamCity that allows remote code execution due to a whitelist bypass in the build messages protocol. It affects versions prior to 2026.2, 2026.1.4, and 2025.11.8. The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data).

CVE-2026-111093 is a path traversal vulnerability in JetBrains Datalore versions before 2026.2.1. It allows unauthenticated attackers to read arbitrary files via the report blob endpoint. The vulnerability has a high severity with a CVSS score of 7.5, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality only.

CVE-2026-111092 is a vulnerability in JetBrains YouTrack that affects versions before 2026.2.19575 and specific 2026.3.x builds (16075, 16397, 16402). It allows a project administrator to execute cross-project issue commands via mail rules, which is a privilege escalation issue related to improper authorization (CWE-862). The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-111091 is a high-severity vulnerability in JetBrains Junie CLI versions before 26.8.3. It allows code execution through an untrusted project's MCP server configuration. The vulnerability is identified as CWE-829, which involves inclusion of untrusted code. The CVSS 3.1 base score is 7.8, indicating significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The issue is fixed in version 26.8.3.

JetBrains Exposed versions before 1.5.1 are vulnerable to SQL injection due to unescaped string arguments in several SQL functions. This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability. The issue is tracked as CVE-2026-108474 and has a critical severity with a CVSS score of 9.8. A fixed version, 1.5.1, is available to remediate this vulnerability.

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

CVE-2026-106218 is a high-severity vulnerability in JetBrains TeamCity before version 2026.1.3. It involves a Kotlin DSL sandbox escape that could lead to remote code execution (RCE) on the server. The vulnerability is identified as CWE-184, which relates to improper access control. No official patch links are provided in the data, and no known exploits are reported in the wild.

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

CVE-2026-103494 is a privilege escalation vulnerability in JetBrains YouTrack versions before 2026.2.19422. The issue arises from improper control over user group membership changes, allowing users with certain privileges to escalate their access rights. The vulnerability has a CVSS score of 6.6, indicating a medium severity level.

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

CVE-2026-103490 is a privilege escalation vulnerability in JetBrains YouTrack versions prior to 2026.2.19422. The issue arises from improper access control related to user group links, classified under CWE-862. This vulnerability allows users with certain privileges to escalate their access rights, potentially leading to full control over the affected system. The vulnerability has a high severity rating with a CVSS score of 7.2. No known exploits are reported in the wild, and no official patch links are provided in the input data.

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible