CVEs (157)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations |
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed |
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates |
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters |
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible |
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates |
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission |
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset |
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access |
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export |
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible |
In JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type parameters |
In JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint |
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible |
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint |
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint |
In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature |
In JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint |