In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session

In JetBrains GoLand before 2025.1 an XXE during debugging was possible

In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file

In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning

In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition

In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload

In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation

In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files

In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration