Skip to contentJetbrains Youtrack vulnerabilities
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any...CVE-2026-864994.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources...CVE-2026-864987.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication...CVE-2026-864976.8 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters...CVE-2026-864964.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge...CVE-2026-864956.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to...CVE-2026-864947.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to...CVE-2026-864936.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of...CVE-2026-864928.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization...CVE-2026-864913.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of...CVE-2026-864906.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private...CVE-2026-864896.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints...CVE-2026-864886.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only...CVE-2026-864873.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its...CVE-2026-864863.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket...CVE-2026-864853.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to...CVE-2026-864844.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was...CVE-2026-864835.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege...CVE-2026-864828.8 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted...CVE-2026-864814.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing authorisation...CVE-2026-864798.0 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack...CVE-2026-86478Public exploit9.8 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was...CVE-2026-750518.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type...CVE-2026-750507.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read...CVE-2026-750496.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was...CVE-2026-750488.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the...CVE-2026-750476.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the...CVE-2026-750464.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated...CVE-2026-75045Public exploit9.1 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation...CVE-2026-750448.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3...CVE-2026-6242210.0 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was...CVE-2026-614923.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possibleCVE-2026-597913.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype...CVE-2026-579262.6 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries...CVE-2026-579254.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user...CVE-2026-579244.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations...CVE-2026-579235.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possibleCVE-2026-579223.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private...CVE-2026-579214.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of...CVE-2026-493866.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to...CVE-2026-493856.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requestsCVE-2026-493703.4 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups...CVE-2026-493694.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possibleCVE-2026-493688.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypassCVE-2026-333927.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions...CVE-2026-281938.8 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logsCVE-2026-258466.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limitCVE-2025-647732.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data...CVE-2025-646858.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback formCVE-2025-646844.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram contentCVE-2025-577318.7 High
- Show moreLoading…