JetBrains YouTrack vulnerabilities
141 published CVEs name JetBrains YouTrack among the affected products.
- 141Published CVEs141 of them scored
- 96Last 12 monthspublished in the last year
- 3Critical33 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-123850
In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
JetBrains · YouTrack
Low3.5 - CVE-2026-123337
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
JetBrains · YouTrack
Low3.1 - CVE-2026-123336
In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
JetBrains · YouTrack
Low3.1 - CVE-2026-123335
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
JetBrains · YouTrack
Low3.5 - CVE-2026-123334
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
JetBrains · YouTrack
Low3.8 - CVE-2026-123333
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
JetBrains · YouTrack
Low3.8 - CVE-2026-123332
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
JetBrains · YouTrack
Medium4.7 - CVE-2026-123331
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
JetBrains · YouTrack
Medium5.4 - CVE-2026-123330
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
JetBrains · YouTrack
Medium5.4 - CVE-2026-123329
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
JetBrains · YouTrack
Medium5.4