JetBrains YouTrack

• CVE-2026-86485 Low 3.5 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks 0.2%
• CVE-2026-86484 Medium 4.6 In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS 0.6%
• CVE-2026-86483 Medium 5.4 In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible 0.6%
• CVE-2026-86482 High 8.8 In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation 0.4%
• CVE-2026-86481 Medium 4.3 In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons 0.3%
• CVE-2026-86479 High 8.0 In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR 0.4%
• CVE-2026-86478 Critical 9.8 In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address 0.6%
• CVE-2026-75051 High 8.1 In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible 0.4%
• CVE-2026-75050 High 7.1 In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters 1.1%
• CVE-2026-75049 Medium 6.5 In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint 0.3%
• CVE-2026-75048 High 8.2 In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible 0.3%
• CVE-2026-75047 Medium 6.5 In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint 1.2%
• CVE-2026-75046 Medium 4.3 In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint 0.3%
• CVE-2026-75045 Critical 9.1 In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature 0.5%
• CVE-2026-75044 High 8.1 In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint 0.4%
• CVE-2026-62422 Critical 10.0 In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access w 0.6%
• CVE-2026-61492 Low 3.5 In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible 0.7%
• CVE-2026-59791 Low 3.5 In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible 0.2%
• CVE-2026-57926 Low 2.6 In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack 0.3%
• CVE-2026-57925 Medium 4.3 In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags 0.3%
• CVE-2026-57924 Medium 4.3 In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details 0.3%
• CVE-2026-57923 Medium 5.3 In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings 0.3%
• CVE-2026-57922 Low 3.1 In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible 0.2%
• CVE-2026-57921 Medium 4.3 In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint 0.3%
• CVE-2026-49386 Medium 6.5 In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas 0.3%
• CVE-2026-49385 Medium 6.5 In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts 0.2%
• CVE-2026-49370 Low 3.4 In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests 0.2%
• CVE-2026-49369 Medium 4.3 In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages 0.2%
• CVE-2026-49368 High 8.7 In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible 0.2%
• CVE-2026-33392 High 7.2 In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass 0.4%
• CVE-2026-28193 High 8.8 In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint 0.3%
• CVE-2026-25846 Medium 6.5 In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs 1.0%
• CVE-2025-64773 Low 2.7 In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit 0.2%
• CVE-2025-64685 High 8.1 In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure 0.2%
• CVE-2025-64684 Medium 4.5 In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form 0.3%
• CVE-2025-57731 High 8.7 In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content 0.3%
• CVE-2025-54527 Medium 6.1 In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions 0.3%
• CVE-2025-53959 High 7.6 In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible 0.3%
• CVE-2025-47850 Medium 4.3 In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning 0.4%
• CVE-2025-48391 High 7.7 In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API 0.4%
• CVE-2025-24458 High 7.1 In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration 0.2%
• CVE-2025-24457 Medium 5.5 In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs 0.6%
• CVE-2024-54158 Low 3.5 In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding 0.3%
• CVE-2024-54157 Medium 4.3 In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector 0.6%
• CVE-2024-54156 Medium 4.2 In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack 0.3%
• CVE-2024-54155 Low 3.7 In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication 0.4%
• CVE-2024-54154 High 8.0 In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox 0.7%
• CVE-2024-54153 Low 3.1 In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter 0.4%
• CVE-2024-50582 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements 0.3%
• CVE-2024-50581 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag 0.3%