IP Spoofing via HTTP Headers Allows Forged Bitbucket Webhooks in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

Stored XSS via AngularJS Template Injection in JetBrains YouTrack Assignee Names

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

Stored XSS via Custom Field on Agile Board Cards in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

Signed URL Reuse Exposes Restricted Project Icons

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

Unauthenticated Service Registration Grants Superuser Privileges in JetBrains Hub

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

Authorization Bypass via IDOR in JetBrains YouTrack REST APIs

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

Unauthenticated Account Takeover via Self‑Asserted Email Authentication in YouTrack Helpdesk

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

Local Command Execution via Crafted Markdown Preview in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

Ktor WebSocket Decompression Denial of Service Vulnerability

In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible