Tagged “cve.org”
CVEs tagged cve.org, newest first.
46330 CVEsRSS
CVE-2026-123302High· 7.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery
CVE-2026-123312Low· 3.3In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
CVE-2026-123313Low· 3.3In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
CVE-2026-123310Medium· 5.4In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects
In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects
CVE-2026-123309Medium· 6.1In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
CVE-2026-123315High· 7.0In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
CVE-2026-123311Medium· 5.3In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
CVE-2026-123318Medium· 4.8In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
CVE-2026-123316Medium· 5.5In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs
CVE-2026-123317High· 8.1In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
CVE-2026-123314Low· 3.1In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
CVE-2026-123322Medium· 6.3In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
CVE-2026-123319Low· 3.7In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection
CVE-2026-123323High· 8.4In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
CVE-2026-123320Low· 3.1In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
CVE-2026-123324High· 7.7In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
CVE-2026-123321High· 7.8In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects
In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects
CVE-2026-123325High· 7.1In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
CVE-2026-123328Medium· 6.4In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
CVE-2026-123326High· 7.1In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
CVE-2026-123329Medium· 5.4In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
CVE-2026-123327High· 7.5In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
CVE-2026-123331Medium· 5.4In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
CVE-2026-123330Medium· 5.4In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
CVE-2026-123333Low· 3.8In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
CVE-2026-123332Medium· 4.7In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
CVE-2026-123335Low· 3.5In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
CVE-2026-123334Low· 3.8In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
CVE-2026-113431High· 8.7Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4…
CVE-2026-123337Low· 3.1In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility