Priority LOW 19
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00172 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-862
Priority LOW 28
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00248 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-918
Priority LOW 22
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00235 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority MEDIUM 43
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00289 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 32
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00216 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 30
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
CVSS 3.1MEDIUM 6.9· Network · High privileges · User interaction · EPSS 0.0019 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-79
Priority LOW 30
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00843 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-770
Priority MEDIUM 43
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00302 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 22
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00287 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-639
Priority LOW 13
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00227 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-862
Priority LOW 15
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
CVSS 3.1LOW 3.3· Network · High privileges · No interaction · EPSS 0.00177 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-863
Priority LOW 19
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00203 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-862
Priority LOW 33
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00229 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-639
Priority LOW 26
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00286 · Published 2026-09-30 · Fixed in 2026.2.19197 CWE-1333
THREATIST.IORead the docs