See how jetbrains compares to other vendors in security performance
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses