Total
157 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-33392 | 1 Jetbrains | 1 Youtrack | 2026-10-26 | N/A | 7.2 HIGH |
| In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass | |||||
| CVE-2026-57923 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 5.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | |||||
| CVE-2026-57921 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint | |||||
| CVE-2026-57925 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags | |||||
| CVE-2026-57924 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details | |||||
| CVE-2026-57922 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 3.1 LOW |
| In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | |||||
| CVE-2026-57926 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 2.6 LOW |
| In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack | |||||
| CVE-2026-61492 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 3.5 LOW |
| In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible | |||||
| CVE-2026-59791 | 1 Jetbrains | 1 Youtrack | 2026-10-24 | N/A | 3.5 LOW |
| In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible | |||||
| CVE-2026-62422 | 1 Jetbrains | 1 Youtrack | 2026-10-24 | N/A | 10.0 CRITICAL |
| In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | |||||
| CVE-2026-75049 | 1 Jetbrains | 1 Youtrack | 2026-10-23 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint | |||||
| CVE-2026-75051 | 1 Jetbrains | 1 Youtrack | 2026-10-23 | N/A | 8.1 HIGH |
| In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible | |||||
| CVE-2026-75050 | 1 Jetbrains | 1 Youtrack | 2026-10-23 | N/A | 7.1 HIGH |
| In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters | |||||
| CVE-2026-75048 | 1 Jetbrains | 1 Youtrack | 2026-10-23 | N/A | 8.2 HIGH |
| In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible | |||||
| CVE-2025-64773 | 1 Jetbrains | 1 Youtrack | 2026-10-18 | N/A | 2.7 LOW |
| In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit | |||||
| CVE-2026-103488 | 1 Jetbrains | 1 Youtrack | 2026-10-05 | N/A | 7.1 HIGH |
| In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues | |||||
| CVE-2026-103489 | 1 Jetbrains | 1 Youtrack | 2026-10-05 | N/A | 2.0 LOW |
| In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | |||||
| CVE-2026-103490 | 1 Jetbrains | 1 Youtrack | 2026-10-05 | N/A | 7.2 HIGH |
| In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | |||||
| CVE-2026-100257 | 1 Jetbrains | 1 Youtrack | 2026-10-02 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export | |||||
| CVE-2026-100258 | 1 Jetbrains | 1 Youtrack | 2026-10-02 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings | |||||