JetBrains

Records788All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical84CVSS 9.0–10.0

CVSS high249CVSS 7.0–8.9

Exploited now

JetBrains records in CISA KEV

TI-2026-45031 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2026-08-05 TI-2024-18054 JetBrains TeamCity Relative Path Traversal Vulnerability CRITICAL 89KEV 2026-04-20 TI-2024-18053 JetBrains TeamCity Authentication Bypass Vulnerability CRITICAL 100KEV 2024-03-07 TI-2023-22884 JetBrains TeamCity Authentication Bypass Vulnerability CRITICAL 100KEV 2023-10-04

Components

Products in the NVD configurations · select one to filter the records

Teamcity 283 records CRITICAL Youtrack 157 records MEDIUM Intellij Idea 77 records HIGH Hub 37 records MEDIUM Ktor 21 records MEDIUM Pycharm 12 records HIGH Toolbox 11 records MEDIUM Rider 9 records HIGH

Records

157 records in Youtrack · all components

TI-2026-44538 CVE-2026-62422 · GHSA-cfrg-hc6v-824g

Missing authentication in JetBrains YouTrack

MEDIUM 50

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00611 Published 2026-07-14 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 CWE-306

TI-2022-08314 CVE-2022-24442 · GHSA-4vjv-fmc3-6724

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

MEDIUM 49

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03754 Published 2022-02-25 No fix listed CWE-94

TI-2026-52731 CVE-2026-75045 · GHSA-68v9-f358-h326

Authentication bypass in JetBrains YouTrack

MEDIUM 48

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00466 Published 2026-08-17 Fixed in 2025.3.156085, 2026.1.13913 +1 CWE-288

TI-2021-07854 CVE-2021-25770 · GHSA-j9h8-94jh-mvvv

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was…

MEDIUM 48

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03621 Published 2021-02-03 No fix listed CWE-94

TI-2021-19197 CVE-2021-43185 · GHSA-vv73-h85j-cqvw

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.

MEDIUM 46

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02008 Published 2021-11-09 No fix listed CWE-74

TI-2019-09636 CVE-2019-12867 · GHSA-58q6-398m-6x2h

Certain actions could cause privilege escalation for issue attachments in JetBrains…

MEDIUM 46

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01994 Published 2019-07-03 No fix listed

TI-2019-09635 CVE-2019-12866 · GHSA-76p4-4v5g-fpxr

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled…

MEDIUM 46

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01939 Published 2019-07-03 No fix listed CWE-639

TI-2019-09629 CVE-2019-12852 · GHSA-mgw6-8fch-vq9v

An SSRF attack was possible on a JetBrains YouTrack server.

MEDIUM 46

An SSRF attack was possible on a JetBrains YouTrack server.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01836 Published 2019-07-03 No fix listed CWE-918

TI-2019-09627 CVE-2019-12850 · GHSA-3xh3-pc52-c4v9

A query injection was possible in JetBrains YouTrack.

MEDIUM 46

A query injection was possible in JetBrains YouTrack.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02079 Published 2019-07-03 No fix listed CWE-89

TI-2024-36269 CVE-2024-54154 · GHSA-3j57-8hvg-f4cv

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

MEDIUM 44

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00742 Published 2024-12-04 Fixed in 2024.3.51866 CWE-23

TI-2026-64618 CVE-2026-100277 · GHSA-mqhr-7f7q-h475

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

MEDIUM 43

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00289 Published 2026-09-30 Fixed in 2026.2.19197 CWE-863

TI-2026-64614 CVE-2026-100273 · GHSA-3c9g-jqwf-qrr8

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

MEDIUM 43

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00302 Published 2026-09-30 Fixed in 2026.2.19197 CWE-863

TI-2026-41705 CVE-2026-57926 · GHSA-pwj4-f48q-v2h2

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

MEDIUM 42

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00337 Published 2026-06-26 Fixed in 2026.2.16593 CWE-1321

TI-2021-15439 CVE-2021-37549 · GHSA-8v2q-93c9-r4q3

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.

MEDIUM 42

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01346 Published 2021-08-06 No fix listed

TI-2020-12446 CVE-2020-15817 · GHSA-mx3g-vxfx-q944

In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.

MEDIUM 42

In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02038 Published 2020-08-08 No fix listed

TI-2026-22532 CVE-2026-28193 · GHSA-8p8j-jq9g-4f8j

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

MEDIUM 40

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0028 Published 2026-02-25 Fixed in 2025.3.121962 CWE-862

TI-2023-17529 CVE-2023-35053 · GHSA-g8p2-h5rv-crgp

In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms

MEDIUM 40

In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-06-12 Fixed in 2023.1.10518 CWE-400

TI-2025-35627 CVE-2025-57731 · GHSA-85j5-6wc8-h3qh

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

LOW 39

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00284 Published 2025-08-20 Fixed in 2025.2.92387 CWE-79

TI-2024-25741 CVE-2024-38505 · GHSA-h8w4-4g94-23mh

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site

LOW 39

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00443 Published 2024-06-18 Fixed in 2024.2.34646 CWE-522

TI-2023-19492 CVE-2023-38068 · GHSA-p77m-f595-qx5v

In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms

LOW 39

In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0055 Published 2023-07-12 Fixed in 2023.1.16597 CWE-799

TI-2021-07849 CVE-2021-25765 · GHSA-gxw3-qv94-46j5

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.

LOW 39

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00717 Published 2021-02-03 No fix listed CWE-352

TI-2019-11226 CVE-2019-15040 · GHSA-j4m3-w4j4-p368

JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.

LOW 39

JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00759 Published 2019-10-02 No fix listed CWE-352

TI-2019-09628 CVE-2019-12851 · GHSA-266j-gpf6-27hm

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack.

LOW 39

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00751 Published 2019-07-03 No fix listed CWE-352

TI-2024-33075 CVE-2024-49579 · GHSA-2jrg-m6qw-2x74

Improper verification of communication channel in JetBrains YouTrack

LOW 38

In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00448 Published 2024-10-17 Fixed in 2024.3.47197 CWE-940

TI-2026-65712 CVE-2026-103493 · GHSA-6qqm-669w-6778

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

LOW 37

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00221 Published 2026-10-01 Fixed in 2026.2.19422 CWE-79

Open these records in search →

Critical	84
High	249
Medium	403
Low	52
No CVSS	0