1842 matches found
PT-2026-103754
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description Privilege escalation is possible through the modification of user group memberships. Recommendations Update to version 2026.2.19422...
PT-2026-103753
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...
CVE-2026-100276
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...
CVE-2026-100278
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...
CVE-2026-100275
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...
CVE-2026-100277
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature...
CVE-2026-100279
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...
CVE-2026-100280
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible...
CVE-2026-100268
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates...
CVE-2026-100271
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects...
CVE-2026-100272
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...
CVE-2026-100273
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution...
CVE-2026-100269
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed...
CVE-2026-100270
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations...
CVE-2026-100274
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template...
CVE-2026-100264
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host...
CVE-2026-100262
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates...
CVE-2026-100263
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...