JetBrains YouTrack

• CVE-2026-111092 Medium 6.5 In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands 0.3%
• CVE-2026-103497 Medium 5.5 In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration 0.2%
• CVE-2026-103496 Medium 5.4 In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications 0.1%
• CVE-2026-103495 Medium 4.3 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs 0.2%
• CVE-2026-103494 Medium 6.6 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes 0.2%
• CVE-2026-103493 High 8.1 In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible 0.2%
• CVE-2026-103492 Medium 6.5 In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments 0.7%
• CVE-2026-103491 Medium 6.5 In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues 0.2%
• CVE-2026-103490 High 7.2 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links 0.3%
• CVE-2026-103489 Low 2.0 In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible 0.3%
• CVE-2026-103488 High 7.1 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues 0.2%
• CVE-2026-100280 Low 3.1 In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible 0.2%
• CVE-2026-100279 Medium 6.5 In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials 0.2%
• CVE-2026-100278 Medium 4.9 In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments 0.2%
• CVE-2026-100277 High 8.9 In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature 0.3%
• CVE-2026-100276 Medium 5.9 In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action 0.2%
• CVE-2026-100275 Medium 6.9 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible 0.2%
• CVE-2026-100274 Medium 6.5 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template 0.8%
• CVE-2026-100273 High 8.2 In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution 0.3%
• CVE-2026-100272 Medium 4.9 In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues 0.3%
• CVE-2026-100271 Low 2.7 In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects 0.2%
• CVE-2026-100270 Low 3.3 In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations 0.2%
• CVE-2026-100269 Medium 4.3 In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed 0.2%
• CVE-2026-100268 High 7.7 In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates 0.2%
• CVE-2026-100267 Medium 5.9 In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters 0.3%
• CVE-2026-100264 Low 2.7 In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host 0.2%
• CVE-2026-100263 Medium 4.7 In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible 0.2%
• CVE-2026-100262 High 7.6 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates 0.2%
• CVE-2026-100261 Medium 5.4 In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission 0.2%
• CVE-2026-100260 Medium 5.3 In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset 0.3%
• CVE-2026-100259 Medium 4.3 In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access 0.2%
• CVE-2026-100258 Medium 4.3 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings 0.7%
• CVE-2026-100257 Medium 4.3 In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export 0.2%
• CVE-2026-86500 Medium 5.5 In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin 0.3%
• CVE-2026-86499 Medium 4.3 In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission 0.3%
• CVE-2026-86498 High 7.7 In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission 0.3%
• CVE-2026-86497 Medium 6.8 In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials 0.5%
• CVE-2026-86496 Medium 4.3 In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses 0.3%
• CVE-2026-86495 Medium 6.5 In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects 0.3%
• CVE-2026-86494 High 7.7 In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues 0.3%
• CVE-2026-86493 Medium 6.5 In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards 0.3%
• CVE-2026-86492 High 8.5 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens 0.9%
• CVE-2026-86491 Low 3.5 In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads 0.2%
• CVE-2026-86490 Medium 6.5 In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint 0.3%
• CVE-2026-86489 Medium 6.5 In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations 0.3%
• CVE-2026-86488 Medium 6.5 In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches 0.3%
• CVE-2026-86487 Low 3.1 In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content 0.2%
• CVE-2026-86486 Low 3.7 In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank 0.3%
• CVE-2026-86485 Low 3.5 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks 0.2%
• CVE-2026-86484 Medium 4.6 In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS 0.6%