3.5
CVSS
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
Severity: LOW
📦
youtrack
Vendor: jetbrains
Actively Exploited
0
CISA KEV List
PoC / Exploits
1
Code Available
Total RCEs
5
Remote Access
Total CVEs
144
Total Indexed
Avg. EPSS
0.84%
Exploit Prob.
Security Vulnerability Index
Page 1 / 15
3.5
CVSS
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
Severity: LOW
2.6
CVSS
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
Severity: LOW
4.3
CVSS
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
Severity: MEDIUM
4.3
CVSS
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
Severity: MEDIUM
5.3
CVSS
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
Severity: MEDIUM
3.1
CVSS
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
Severity: LOW
4.3
CVSS
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
Severity: MEDIUM
6.5
CVSS
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
Severity: MEDIUM
6.5
CVSS
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
Severity: MEDIUM