Vulnerabilidades

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible