Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs