YouTrack Project Settings Disclosure via MCP

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

Remote Code Execution via Untrusted Project Configuration in JetBrains GoLand

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

Authentication Bypass via Direct Database Access Granting Administrative Access

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

Privilege Escalation via Authentication Detail Attachment in JetBrains Hub

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

Predictable Restore Codes Allow Account Takeover in JetBrains Hub

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

Missing Authorization Allows Project Developers to Add Build Parameters

In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations

In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.

Improper Permission Checks Exposing Build Configuration Parameters

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page

Insufficient Username Validation in TeamCity SAML Plugin

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

TeamCity Parameter Autocompletion Reveals Credentials

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

Credentials Exposed Through Thread Names in JetBrains TeamCity

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

JetBrains TeamCity SAML Plugin Open Redirect Vulnerability

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible

Stored XSS Vulnerability on TeamCity SAML Login Page

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

Unauthenticated SSRF via Build Status in JetBrains TeamCity

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

Reflected XSS in JetBrains TeamCity Keyword Filter

In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

Template Injection in IntelliJ IDEA Copyright Plugin Enables Code Execution

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

Command Injection via Filename Completion in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion