| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints |
| In JetBrains YouTrack before 2026.2.19562,
2026.1.14137,
2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection |
| In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles |
| In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project |
| In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings |
| In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations |
| In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server |
| In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives |
| In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model |
| In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories |
| In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition |
| An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly. |
| The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them. |
| In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives |
| In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects |
| In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration |
| In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects |
| In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection |
| In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects |
| A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system. |
