CVE-2026-28194

This vulnerability allows an attacker with access to the TeamCity server to find and potentially misuse leftover credentials stored on the disk if versioned settings are disabled. It requires the attacker to have some level of access to the server where TeamCity is running.

This vulnerability allows an attacker to add unauthorized parameters to build configurations in JetBrains TeamCity, potentially leading to malicious code execution or data exposure. It occurs when project developers are not properly restricted, meaning anyone with access to the project can exploit this flaw.

This vulnerability allows an attacker to send unauthorized requests to the app permissions endpoint in JetBrains YouTrack, potentially gaining access to sensitive information or altering permissions. To exploit this, the attacker needs to be able to interact with the application, meaning they must have some level of access to the YouTrack environment.

An attacker can read sensitive data from temporary files and view directory contents created by JetBrains Kotlin versions before 1.4.21 due to weak security settings on those files. This vulnerability requires the attacker to have access to the system where the vulnerable version of Kotlin is running.