YO
Product
YouTrack
180
CVEs
0
On KEV
9.8
Max CVSS
33
New 30D
Severity mix
Critical 15High 41Medium 112Low 12
Watch
Add YouTrack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86486 | 3.7 | Sep 7 | In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank Affected: before 2026.2.18634 |
| CVE-2025-64773 | 3.7 | Nov 11 | In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit Affected: before 2025.3.104432 |
| CVE-2026-86491 | 3.5 | Sep 7 | In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads Affected: before 2026.2.18634 |
| CVE-2026-59791 | 3.5 | Jul 10 | In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible Affected: before 2026.2.17012 |
| CVE-2026-86485 | 3.3 | Sep 7 | In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks Affected: before 2026.2.18634 |
| CVE-2020-24366 | 3.3 | Nov 16 | Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups Affected: before 2020.2.0 |
| CVE-2026-86487 | 3.1 | Sep 7 | In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content Affected: before 2026.2.18634 |
| CVE-2026-100271 | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects Affected: before 2026.2.19197 |
| CVE-2026-100270 | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations Affected: before 2026.2.19197 |
| CVE-2026-100268 | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates Affected: before 2026.2.19197 |
| CVE-2026-100264 | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host Affected: before 2026.2.18991 |
| CVE-2020-11692 | 2.7 | Apr 22 | In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators Affected: before 2020.1.659 |
Showing 12