CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,463
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product jetbrains:youtrack. Show all products

83 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2026-111092Medium 6.5In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
Assigned by JetBrains
Oct 15, 2026
CVE-2026-103497Medium 5.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103496Medium 5.4In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103495Medium 4.3In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103494Medium 6.6In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103493High 8.1In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103492Medium 6.5In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103491Medium 6.5In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103490High 7.2In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103489Low 2.0In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
Assigned by JetBrains
Oct 1, 2026
CVE-2026-103488High 7.1In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
Assigned by JetBrains
Oct 1, 2026
CVE-2026-100280Low 3.1In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100279Medium 6.5In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100278Medium 4.9In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100277High 8.9In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100276Medium 5.9In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100275Medium 6.9In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100274Medium 6.5In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100273High 8.2In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100272Medium 4.9In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100271Low 2.7In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100270Low 3.3In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100269Medium 4.3In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100268High 7.7In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100267Medium 5.9In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100264Low 2.7In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100263Medium 4.7In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100262High 7.6In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100261Medium 5.4In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100260Medium 5.3In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100259Medium 4.3In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100258Medium 4.3In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100257Medium 4.3In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
Assigned by JetBrains
Sep 30, 2026
CVE-2026-86500Medium 5.5In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86499Medium 4.3In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86498High 7.7In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86497Medium 6.8In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86496Medium 4.3In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86495Medium 6.5In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86494High 7.7In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86493Medium 6.5In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86492High 8.5In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86491Low 3.5In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86490Medium 6.5In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86489Medium 6.5In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86488Medium 6.5In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86487Low 3.1In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86486Low 3.7In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86485Low 3.5In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
Assigned by JetBrains
Sep 7, 2026
CVE-2026-86484Medium 4.6In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
Assigned by JetBrains
Sep 7, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.