Priority LOW 24
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00152 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-918
Priority LOW 23
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00138 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-639
Priority LOW 19
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00195 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-862
Priority LOW 31
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.00211 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-266
Priority LOW 37
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00221 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-79
Priority LOW 30
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00683 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-835
Priority LOW 28
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00201 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-639
Priority LOW 33
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00257 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-862
Priority LOW 24
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00339 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-79
Priority LOW 31
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00211 · Published 2026-10-01 · Fixed in 2026.2.19422 CWE-863
Priority LOW 19
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00172 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-862
Priority LOW 28
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00248 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-918
Priority LOW 22
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00235 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority MEDIUM 43
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00289 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 32
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00216 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 30
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
CVSS 3.1MEDIUM 6.9· Network · High privileges · User interaction · EPSS 0.0019 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-79
Priority LOW 30
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00843 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-770
Priority MEDIUM 43
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00302 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 22
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00287 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-639
Priority LOW 13
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00227 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-862
Priority LOW 15
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
CVSS 3.1LOW 3.3· Network · High privileges · No interaction · EPSS 0.00177 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 19
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00203 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-862
Priority LOW 33
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00229 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-639
Priority LOW 26
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00286 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-1333
Priority LOW 13
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00227 · Published 2026-09-30 · Fixed in 2026.2.18991 CWE-522
Load more
THREATIST.IORead the docs