In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest

In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API

In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible

In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered

JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon

JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page

JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS

In JetBrains YouTrack before 2021.3.21051, stored XSS is possible

In JetBrains YouTrack before 2021.2.17925, stored XSS was possible

In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning

In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible

In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles

In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible

In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly

In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made

In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions

JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF

In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues

JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF

In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence

JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports

In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence

In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings