YouTrack at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 16 | 0 |
| Oct 2026 | 11 | 0 |
| Sep 2026 | 44 | 1 |
| Aug 2026 | 8 | 1 |
| Jul 2026 | 3 | 1 |
| Jun 2026 | 6 | 0 |
| May 2026 | 5 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 2 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 2 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 2 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 2 | 0 |
| Dec 2024 | 6 | 0 |
Most common weaknesses
141 results · Feed
-
Low 3.5
In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
-
Low 3.1
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
-
Low 3.8
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by an…
-
Low 3.5
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to …
-
Low 3.1
In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
-
Medium 4.7
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server conf…
-
Low 3.8
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between spri…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other pro…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue vis…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
-
High 7.1
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script discl…
-
High 7.5
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue…
-
Medium 6.4
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
-
High 7.7
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
-
High 7.1
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible …
-
High 8.4
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host a…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to …
-
Medium 5.5
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
-
High 8.1
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
-
Medium 6.6
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
-
High 7.2
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
-
Low 2.0
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
-
High 7.1
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to projec…
-
Low 3.1
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
-
High 8.9
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
-
Medium 6.9
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
-
Medium 5.9
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run t…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
-
High 8.2
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Ad…
-
Low 2.7
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to acc…
-
Low 3.3
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials …
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
-
High 7.7
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notificati…