Total
157 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-100268 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 7.7 HIGH |
| In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates | |||||
| CVE-2026-100267 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 5.9 MEDIUM |
| In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters | |||||
| CVE-2026-103491 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues | |||||
| CVE-2026-103497 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 5.5 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration | |||||
| CVE-2026-103496 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 5.4 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications | |||||
| CVE-2026-103495 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | |||||
| CVE-2026-103492 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments | |||||
| CVE-2026-75047 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint | |||||
| CVE-2026-75046 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint | |||||
| CVE-2026-75044 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 8.1 HIGH |
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint | |||||
| CVE-2026-75045 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 9.1 CRITICAL |
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature | |||||
| CVE-2026-49385 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts | |||||
| CVE-2026-49386 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas | |||||
| CVE-2026-49369 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages | |||||
| CVE-2026-49370 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 3.4 LOW |
| In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests | |||||
| CVE-2026-49368 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 8.7 HIGH |
| In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible | |||||
| CVE-2026-28193 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 8.8 HIGH |
| In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint | |||||
| CVE-2026-25846 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs | |||||
| CVE-2025-64685 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 8.1 HIGH |
| In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure | |||||
| CVE-2025-64684 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form | |||||