Vulnerabilities

TI-2026-64605 CVE-2026-100264 · GHSA-gr9x-57pc-647p

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

LOW 13

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00227 Published 2026-09-30 Fixed in 2026.2.18991 CWE-522

TI-2026-64604 CVE-2026-100263 · GHSA-wpxv-jj6h-wjr5

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

LOW 27

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00192 Published 2026-09-30 Fixed in 2026.2.18991 CWE-79

TI-2026-64603 CVE-2026-100262 · GHSA-q872-prmj-w466

Incorrect authorization in JetBrains YouTrack

LOW 33

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00211 Published 2026-09-30 Fixed in 2026.2.18991 CWE-863

TI-2026-64602 CVE-2026-100261 · GHSA-xpcv-h458-r782

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

LOW 24

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00175 Published 2026-09-30 Fixed in 2026.2.18991 CWE-288

TI-2026-64601 CVE-2026-100260 · GHSA-m4m6-2637-vqmm

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

LOW 30

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00265 Published 2026-09-30 Fixed in 2026.2.18991 CWE-1188

TI-2026-64600 CVE-2026-100259 · GHSA-9vmv-xhw6-9wrm

Incorrect authorization in JetBrains YouTrack

LOW 19

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-09-30 Fixed in 2026.2.18991 CWE-863

TI-2026-64599 CVE-2026-100258 · GHSA-2gwh-9qxr-7j66

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

LOW 21

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00652 Published 2026-09-30 Fixed in 2026.2.18991 CWE-201

TI-2026-64598 CVE-2026-100257 · GHSA-cr25-22xp-44g2

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

LOW 19

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00206 Published 2026-09-30 Fixed in 2026.2.18991 CWE-918

Vulnerabilities

Filters