Login Request a demo
YO
Product
YouTrack
by JetBrains · last CVE Oct 15, 2026
180
CVEs
0
On KEV
9.8
Max CVSS
33
New 30D
Vulnerabilities180In the news0Timeline
Severity mix
Critical 15High 41Medium 112Low 12
Severity
All severities180Critical15High41Medium112Low12
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add YouTrack to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-100277
9.8
0%
Sep 30
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
Affected: before 2026.2.19197
CVE-2026-100273
9.8
0%
Sep 30
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
Affected: before 2026.2.19197
CVE-2026-86478
9.8
1%
Sep 7
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
Affected: before 2025.3.161254, 2026.1.14042
CVE-2026-62422
9.8
1%
Jul 14
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to…
Affected: before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
CVE-2026-57926
9.8
0%
Jun 26
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
Affected: before 2026.2.16593
CVE-2024-54154
9.8
1%
Dec 4
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
Affected: before 2024.3.51866
CVE-2022-24442
9.8
4%
Feb 25
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates
Affected: before 2021.4.40426
CVE-2021-43185
9.8
2%
Nov 9
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection
Affected: before 2021.3.23639
CVE-2021-25770
9.8
3%
Feb 3
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution
Affected: before 2020.5.3123
CVE-2019-12852
9.8
2%
Jul 3
An SSRF attack was possible on a JetBrains YouTrack server
Affected: before 2018.4.49168
CVE-2019-12867
9.8
2%
Jul 3
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack
Affected: before 2018.4.49168
CVE-2019-12866
9.8
2%
Jul 3
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack
Affected: before 2018.4.49168
CVE-2019-12850
9.8
2%
Jul 3
A query injection was possible in JetBrains YouTrack
Affected: before 2018.4.49168
CVE-2026-75045
9.1
0%
Aug 17
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
Affected: before 2025.3.156085, 2026.1.13913, 2026.2.18112
CVE-2021-37549
9.1
1%
Aug 6
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient
Affected: before 2021.1.11111
Showing 15