Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option