| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives |
| In JetBrains CLion before 2026.2,
2026.1.4 code execution was possible in Safe Mode via Meson project settings |
| In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account |
| In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition |
| In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories |
| In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion |
| In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server |
| In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database |
| In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option |
| In JetBrains WebStorm before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader |
| In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings |
| In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles |
| In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project |
| In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook |
| In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 sSRF was possible via annotations.xml files during indexing |
| In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension |
| In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation |
| In JetBrains YouTrack before 2026.2.19562,
2026.1.14137,
2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection |