| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration |
| In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data |
| In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible |
| In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible |
| In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default |
| In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session |
| In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files |
| In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open |
| In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling |
| In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling |
| In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter |
| In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session |