5083 matches found
CVE-2026-86488
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches...
CVE-2026-86492
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
CVE-2026-86496
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...
CVE-2026-86489
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...
CVE-2026-86495
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects...
CVE-2026-86484
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...
CVE-2026-86483
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible...
CVE-2026-86479
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR...
CVE-2026-86480
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges...
CVE-2026-86485
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks...
CVE-2026-86486
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...
CVE-2026-86482
In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation...
CVE-2026-86487
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...
CVE-2026-86481
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...
CVE-2026-86478
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...
CVE-2026-86506
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data...
CVE-2026-86506
JetBrains GoLand versions before 2026.2.2.1 are affected by a missing authentication flaw on the profiler's injected pprof server , which could expose profiling data to unauthorized network accessors. The vulnerability carries a CVSS 3.1 score of 5.9 (Medium) , with a network attack vector, high ...
EUVD-2026-72522
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data...