Total
125 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-75049 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint | |||||
| CVE-2026-75048 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 8.2 HIGH |
| In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible | |||||
| CVE-2026-75047 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint | |||||
| CVE-2026-75046 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint | |||||
| CVE-2026-75044 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 8.1 HIGH |
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint | |||||
| CVE-2026-75045 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 9.1 CRITICAL |
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature | |||||
| CVE-2026-75050 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 7.1 HIGH |
| In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters | |||||
| CVE-2026-75051 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 8.1 HIGH |
| In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible | |||||
| CVE-2026-62422 | 1 Jetbrains | 1 Youtrack | 2026-08-12 | N/A | 10.0 CRITICAL |
| In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | |||||
| CVE-2026-49385 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts | |||||
| CVE-2026-49386 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas | |||||
| CVE-2026-49369 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages | |||||
| CVE-2026-49370 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 3.4 LOW |
| In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests | |||||
| CVE-2026-49368 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 8.7 HIGH |
| In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible | |||||
| CVE-2026-59791 | 1 Jetbrains | 1 Youtrack | 2026-07-10 | N/A | 3.5 LOW |
| In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible | |||||
| CVE-2026-61492 | 1 Jetbrains | 1 Youtrack | 2026-07-10 | N/A | 3.5 LOW |
| In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible | |||||
| CVE-2026-57921 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint | |||||
| CVE-2026-57922 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 3.1 LOW |
| In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | |||||
| CVE-2026-57923 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 5.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | |||||
| CVE-2026-57924 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details | |||||