XML External Entity Vulnerability in JetBrains IntelliJ IDEA UI Designer

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

Stored Cross‑Site Scripting in JetBrains YouTrack Notification Templates

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

Information Disclosure on Users and Groups Pages in JetBrains YouTrack

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

YouTrack Information Disclosure via fetchApp Requests

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

Stored XSS Vulnerability in PyCharm Jupyter Notebook Markdown Cells

In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible

Access Control Bypass in JetBrains YouTrack

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

Improper Access Control Allowing Enumeration of Restricted Content on Planning Canvas

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

Arbitrary Local File Access via Built‑in Web Server in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

Command Injection via Malicious Project File in JetBrains Junie

In JetBrains Junie before 252.549.29 command execution was possible via malicious project file

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

High Privileged User Remote Code Execution via Sandbox Bypass in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

Authentication Bypass Allowing Administrative Actions in JetBrains Hub

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

Credentials Configuration Left on Disk After Disabling Versioned Settings

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk

YouTrack Access Tokens Exposed in Mailbox Logs

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs

DOM‑based XSS in PyCharm Jupyter Viewer

In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible

Unauthorized Access to App Permissions in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

Open Redirect in TeamCity React Project Creation Flow

In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow

Authentication Bypass via Account Mismatch in JetBrains Hub

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings