CVE-2026-75051

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75045

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...

CVE-2026-75051

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...

EUVD-2026-60250

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...

CVE-2026-75051

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

EUVD-2026-60247

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75049

JetBrains YouTrack (versions before 2026.1.13903 and 2026.2.17950) has an authorization flaw: an authenticated user with low privileges can use the draft creation endpoint to read restricted articles from other projects, causing high confidentiality impact (CVSS 6.5). No in-the-wlood exploitation...

EUVD-2026-60248

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

EUVD-2026-60249

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75050

In JetBrains YouTrack, crafted type parameters allow a low-privilege network attacker to trigger a denial-of-service condition (CVSS 7.1, HIGH), with availability impact rated HIGH; no exploitation details are provided. Patch versions 2026.1.13901 and 2026.2.17950 are referenced as fixed.

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75048

JetBrains YouTrack before 2026.2.18068 allows stored XSS via the fenced code-block language label; an unauthenticated attacker can inject JavaScript that executes in other users' browsers, scoring CVSS 8.2 HIGH. Exploitation status is not provided in the documents. Upgrade to YouTrack 2026.2.1806...

CVE-2026-75047

JetBrains YouTrack before version 2026.2.18177 is vulnerable to a denial-of-service attack via a decompression bomb submitted to the import endpoint. A low-privileged authenticated user can trigger high availability impact (CVSS 6.5) without user interaction. Exploitation details are not provided...