CVEs (157)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration |
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications |
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs |
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes |
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible |
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments |
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues |
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links |
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible |
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues |
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible |
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials |
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments |
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature |
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action |
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible |
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template |
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution |
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues |
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |