In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint