Browse All CVEs
50,472 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-123331 |
medium | 5.4 | 0.0019 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restr | |
CVE-2026-123330 |
medium | 5.4 | 0.0018 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-on | |
CVE-2026-123329 |
medium | 5.4 | 0.0018 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration al | |
CVE-2026-123328 |
medium | 6.4 | 0.0028 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalati | |
CVE-2026-123327 |
high | 7.5 | 0.0037 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoin | |
CVE-2026-123326 |
high | 7.1 | 0.0027 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger | |
CVE-2026-123325 |
high | 7.1 | 0.0027 | 2026-11-06 | In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untr | |
CVE-2026-123324 |
high | 7.7 | 0.0032 | 2026-11-06 | In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox messag | |
CVE-2026-123323 |
high | 8.4 | 0.0028 | 2026-11-06 | In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL vali | |
CVE-2026-123322 |
medium | 6.3 | 0.0010 | 2026-11-06 | In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted pr | |
CVE-2026-123321 |
high | 7.8 | 0.0019 | 2026-11-06 | In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task load | |
CVE-2026-123320 |
low | 3.1 | 0.0014 | 2026-11-06 | In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed conne | |
CVE-2026-123319 |
low | 3.7 | 0.0016 | 2026-11-06 | In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storag | |
CVE-2026-123318 |
medium | 4.8 | 0.0015 | 2026-11-06 | In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine | |
CVE-2026-123317 |
high | 8.1 | 0.0020 | 2026-11-06 | In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session | |
CVE-2026-123316 |
medium | 5.5 | 0.0043 | 2026-11-06 | In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in sess | |
CVE-2026-123315 |
high | 7.0 | 0.0027 | 2026-11-06 | In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar | |
CVE-2026-123314 |
low | 3.1 | 0.0022 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML res | |
CVE-2026-123313 |
low | 3.3 | 0.0011 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via | |
CVE-2026-123312 |
low | 3.3 | 0.0011 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml | |
CVE-2026-123311 |
medium | 5.3 | 0.0014 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run con | |
CVE-2026-123310 |
medium | 5.4 | 0.0017 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads | |
CVE-2026-123309 |
medium | 6.1 | 0.0023 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-i | |
CVE-2026-123308 |
medium | 6.3 | 0.0014 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possib | |
CVE-2026-123307 |
medium | 6.8 | 0.0027 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbit | |
CVE-2026-123306 |
high | 7.4 | 0.0020 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be | |
CVE-2026-123305 |
high | 7.5 | 0.0034 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Con | |
CVE-2026-123304 |
high | 7.8 | 0.0019 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a config | |
CVE-2026-123302 |
high | 7.8 | 0.0019 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code executi | |
CVE-2026-123301 |
high | 8.2 | 0.0027 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view w | |
CVE-2026-123300 |
low | 2.7 | 0.0027 | 2026-11-06 | In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only ac | |
CVE-2026-123299 |
low | 3.1 | 0.0022 | 2026-11-06 | In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was po | |
CVE-2026-123298 |
medium | 5.0 | 0.0064 | 2026-11-06 | In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was pos | |
CVE-2026-123297 |
medium | 6.8 | 0.0034 | 2026-11-06 | In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the | |
CVE-2026-123296 |
high | 7.5 | 0.0032 | 2026-11-06 | In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification wa | |
CVE-2026-123295 |
high | 8.1 | 0.0039 | 2026-11-06 | In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled | |
CVE-2026-123294 |
critical | 9.6 | 0.0044 | 2026-11-06 | In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email a | |
CVE-2026-123293 |
high | 7.8 | 0.0019 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrust | |
CVE-2026-123292 |
low | 2.7 | 0.0028 | 2026-11-06 | In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users rem | |
CVE-2026-123291 |
medium | 4.3 | 0.0025 | 2026-11-06 | In JetBrains Datalore before 2026.4 improper owner validation allowed reading another work | |
CVE-2026-123290 |
medium | 5.3 | 0.0032 | 2026-11-06 | In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated us | |
CVE-2026-123289 |
medium | 4.3 | 0.0024 | 2026-11-06 | In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to mod | |
CVE-2026-123288 |
medium | 5.4 | 0.0060 | 2026-11-06 | In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega ed | |
CVE-2026-123287 |
high | 7.5 | 0.0029 | 2026-11-06 | In JetBrains Datalore before 2026.4 private notebook files could be downloaded without aut | |
CVE-2026-123286 |
medium | 6.5 | 0.0018 | 2026-11-06 | In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner | |
CVE-2026-123285 |
high | 8.8 | 0.0038 | 2026-11-06 | In JetBrains Datalore before 2026.3 command execution was possible in the database task co | |
CVE-2026-123284 |
medium | 6.5 | 0.0029 | 2026-11-06 | In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view | |
CVE-2026-123283 |
high | 8.1 | 0.0023 | 2026-11-06 | In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre | |
CVE-2026-123282 |
critical | 9.1 | 0.0028 | 2026-11-06 | In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowe | |
CVE-2026-123281 |
high | 8.8 | 0.0037 | 2026-11-06 | In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar co |