YO
Product
YouTrack
180
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 15High 41Medium 112Low 12
Watch
Add YouTrack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-100257 | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export Affected: before 2026.2.18991 |
| CVE-2026-86499 | 4.3 | Sep 7 | In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission Affected: before 2026.1.14047 |
| CVE-2026-86496 | 4.3 | Sep 7 | In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses Affected: before 2026.2.18769 |
| CVE-2026-86481 | 4.3 | Sep 7 | In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons Affected: before 2026.2.18634 |
| CVE-2026-75046 | 4.3 | Aug 17 | In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint Affected: before 2026.2.18112 |
| CVE-2026-49369 | 4.3 | May 29 | In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages Affected: before 2026.1.13162 |
| CVE-2024-47159 | 4.3 | Sep 19 | In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project Affected: before 2024.3.44799 |
| CVE-2023-50871 | 4.3 | Dec 15 | In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed Affected: before 2023.3.22268 |
| CVE-2022-24343 | 4.3 | Feb 25 | In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions Affected: before 2021.4.31698 |
| CVE-2021-37554 | 4.3 | Aug 6 | In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions Affected: before 2021.3.21051 |
| CVE-2021-25771 | 4.3 | Feb 3 | In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed Affected: before 2020.6.1099 |
| CVE-2019-14956 | 4.3 | Oct 2 | JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names Affected: before 2019.2.53938 |