| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions |
| A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API. |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension |
| In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page |
| In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible |
| In JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation |
| In JetBrains WebStorm before 2026.3,
2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader |
| In JetBrains WebStorm before 2026.3,
2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects |
| In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server |
| In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection |
| In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine |
| In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies |
| A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash. |
| In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs |
| In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 xXE attack was possible via an XML response to an HTTP Client request |
| In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 sSRF was possible via annotations.xml files during indexing |
| In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible |
| In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects |
