CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,500
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product jetbrains:youtrack. Show all products

83 CVEs, showing 51 to 83PreviousPage 2 of 2
CVESeverityTitlePublished
CVE-2026-100257Medium 4.3In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100258Medium 4.3In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100259Medium 4.3In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100260Medium 5.3In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100261Medium 5.4In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100262High 7.6In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100263Medium 4.7In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100264Low 2.7In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100267Medium 5.9In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100268High 7.7In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100269Medium 4.3In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100270Low 3.3In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100271Low 2.7In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100272Medium 4.9In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100273High 8.2In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100274Medium 6.5In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100275Medium 6.9In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100276Medium 5.9In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100277High 8.9In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100278Medium 4.9In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100279Medium 6.5In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100280Low 3.1In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
Assigned by JetBrains
Sep 30, 2026
CVE-2026-103488High 7.1In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103489Low 2.0In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103490High 7.2In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103491Medium 6.5In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103492Medium 6.5In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103493High 8.1In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103494Medium 6.6In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103495Medium 4.3In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103496Medium 5.4In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103497Medium 5.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
Assigned by JetBrains
Oct 1, 2026
CVE-2026-111092Medium 6.5In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
Assigned by JetBrains
Oct 15, 2026
PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.