EUVD-2026-60246

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75046

JetBrains YouTrack before 2026.2.18112 has an authenticated user enumeration flaw in the users search endpoint, allowing account discovery (CVSS 4.3 MEDIUM). No exploitation details are provided; upgrade to 2026.2.18112 or later. Monitor JetBrains issue tracker for further advisories.

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75044

In JetBrains YouTrack before versions 2025.3.156085, 2026.1.13914, and 2026.2.18095, a missing authorization check on the mailbox endpoint allowed any authenticated user to delete arbitrary entities, causing high integrity and availability impact (CVSS 8.1). No in-the-wild exploitation is reporte...

EUVD-2026-60243

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2025-27772 Uptrain vulnerable to remote code execution via `/new_run` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

CVE-2025-27772 Uptrain vulnerable to remote code execution via `/new_run` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

CVE-2025-27772

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

EUVD-2025-210736

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

CVE-2025-27772

UpTrain versions 0.7.1 and earlier are vulnerable to remote code execution (CVSS 8.7 HIGH): the /new_run endpoint's checks and metadata parameters allow arbitrary code execution within the host container. A proof-of-concept exploit exists; no patch is currently available. Affected users should re...

CVE-2025-27771 Uptrain vulnerable to remote code execution via `/add_prompts` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27771

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27770 UpTrain vulnerable to Remote code execution at `/create_project`

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...

EUVD-2025-210734

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...

CVE-2025-27770

UpTrain versions 0.7.1 and earlier expose the /create_project endpoint, where the checks and metadata parameters are deserialized without sanitization, enabling authenticated users to execute arbitrary Python code inside the host container. CVSS 4.0 scores 8.7 (HIGH); exploitPoC exists, no patch ...

CVE-2025-27770 UpTrain vulnerable to Remote code execution at `/create_project`

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...