CVE-2026-28195

This vulnerability allows an attacker with access to the TeamCity server to find and potentially misuse leftover credentials stored on the disk if versioned settings are disabled. It requires the attacker to have some level of access to the server where TeamCity is running.

This vulnerability allows an attacker to redirect users to malicious websites during the project creation process in JetBrains TeamCity. It can be exploited if an attacker tricks a user into clicking a specially crafted link while using an affected version of the software.

This vulnerability allows an attacker to send unauthorized requests to the app permissions endpoint in JetBrains YouTrack, potentially gaining access to sensitive information or altering permissions. To exploit this, the attacker needs to be able to interact with the application, meaning they must have some level of access to the YouTrack environment.

An attacker can read sensitive data from temporary files and view directory contents created by JetBrains Kotlin versions before 1.4.21 due to weak security settings on those files. This vulnerability requires the attacker to have access to the system where the vulnerable version of Kotlin is running.