Two‑Factor Authentication Bypass via Password Reset in JetBrains Hub

In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

Bypassing MFA Enforcement via Profile Update Endpoint in JetBrains Hub

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

TeamCity Perforce Connection Remote Code Execution Vulnerability

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

Command Injection via Enterprise Configuration URLs in JetBrains Toolbox App

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

Code Execution via Project‑Controlled JVM Options in IntelliJ IDEA Safe Mode

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

Code Execution via Unsafe Meson Project Settings in JetBrains CLion Safe Mode

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

JetBrains YouTrack Application Permission Bypass Allowing Privilege Escalation via Project Tab

In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab

Untrusted Remote Code Inclusion via Plugin Sandbox Page in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

SMTP Command Injection via Email Verification in JetBrains Hub

In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

Privilege Escalation via Forged Email Verification in JetBrains Hub

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

Privilege Escalation via Email Authentication Flow in JetBrains Hub

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions

Local user can read debug session environment

In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux

Attachment Size Limit Bypass via AI Assistant Thread Conversion in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion

Information Disclosure via Shared Mailbox Message History in JetBrains YouTrack Before 2026.2.19562

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

Privilege Escalation via Unchecked Visibility Changes in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility

Authorization flaw in JetBrains YouTrack scripts debugger enables script disclosure and suspension

In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

Information Disclosure via User Search Queries in JetBrains Hub

In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible