Veille CVE

Septembre 2026

44 CVE

Critique 3 Élevée 7 Moyenne 26 Faible 8 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « JetBrains YouTrack » ✕
  1. CVE-2026-100280 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

  2. CVE-2026-100279 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

  3. CVE-2026-100278 4.9 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

  4. CVE-2026-100277 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

  5. CVE-2026-100276 7.5 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

  6. CVE-2026-100275 4.8 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

  7. CVE-2026-100274 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

  8. CVE-2026-100273 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

  9. CVE-2026-100272 4.9 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

  10. CVE-2026-100271 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

  11. CVE-2026-100270 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

  12. CVE-2026-100269 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

  13. CVE-2026-100268 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

  14. CVE-2026-100267 5.9 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

  15. CVE-2026-100264 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

  16. CVE-2026-100263 6.1 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

  17. CVE-2026-100262 7.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

  18. CVE-2026-100261 5.4 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

  19. CVE-2026-100260 5.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

  20. CVE-2026-100259 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

  21. CVE-2026-100258 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

  22. CVE-2026-100257 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

  23. CVE-2026-86500 5.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin

  24. CVE-2026-86499 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission

  25. CVE-2026-86498 7.7 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

  26. CVE-2026-86497 6.8 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

  27. CVE-2026-86496 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses

  28. CVE-2026-86495 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects

  29. CVE-2026-86494 7.7 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

  30. CVE-2026-86493 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards

  31. CVE-2026-86492 8.5 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

  32. CVE-2026-86491 3.5 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

  33. CVE-2026-86490 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint

  34. CVE-2026-86489 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations

  35. CVE-2026-86488 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches

  36. CVE-2026-86487 3.1 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content

  37. CVE-2026-86486 3.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

  38. CVE-2026-86485 3.3 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

  39. CVE-2026-86484 4.6 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

  40. CVE-2026-86483 5.4 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

  41. CVE-2026-86482 8.8 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

  42. CVE-2026-86481 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

  43. CVE-2026-86479 8.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

  44. CVE-2026-86478 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address