In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services

In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.

In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.

In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.

In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.

In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning

In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection

In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log

In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.

In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.

In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log

In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly

In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.

In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function

In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.

In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.

JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies

In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.

In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks

In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.

In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.

In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

In JetBrains TeamCity before 2025.11 path traversal was possible via file upload

In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs

JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances.

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.

In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.

In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3.