Veille CVE

Recherche « JetBrains YouTrack »

77 CVE

Critique 6 Élevée 16 Moyenne 46 Faible 9 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « JetBrains YouTrack » ✕
  1. CVE-2026-111092 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

  2. CVE-2026-103497 5.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

  3. CVE-2026-103496 5.4 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

  4. CVE-2026-103495 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

  5. CVE-2026-103494 6.6 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

  6. CVE-2026-103493 8.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

  7. CVE-2026-103492 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

  8. CVE-2026-103491 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

  9. CVE-2026-103490 7.2 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

  10. CVE-2026-103489 5.4 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

  11. CVE-2026-103488 7.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

  12. CVE-2026-100280 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

  13. CVE-2026-100279 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

  14. CVE-2026-100278 4.9 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

  15. CVE-2026-100277 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

  16. CVE-2026-100276 7.5 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

  17. CVE-2026-100275 4.8 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

  18. CVE-2026-100274 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

  19. CVE-2026-100273 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

  20. CVE-2026-100272 4.9 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

  21. CVE-2026-100271 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

  22. CVE-2026-100270 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

  23. CVE-2026-100269 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

  24. CVE-2026-100268 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

  25. CVE-2026-100267 5.9 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

  26. CVE-2026-100264 2.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

  27. CVE-2026-100263 6.1 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

  28. CVE-2026-100262 7.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

  29. CVE-2026-100261 5.4 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

  30. CVE-2026-100260 5.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

  31. CVE-2026-100259 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

  32. CVE-2026-100258 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

  33. CVE-2026-100257 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

  34. CVE-2026-86500 5.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin

  35. CVE-2026-86499 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission

  36. CVE-2026-86498 7.7 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

  37. CVE-2026-86497 6.8 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

  38. CVE-2026-86496 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses

  39. CVE-2026-86495 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects

  40. CVE-2026-86494 7.7 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

  41. CVE-2026-86493 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards

  42. CVE-2026-86492 8.5 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

  43. CVE-2026-86491 3.5 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

  44. CVE-2026-86490 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint

  45. CVE-2026-86489 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations

  46. CVE-2026-86488 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches

  47. CVE-2026-86487 3.1 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content

  48. CVE-2026-86486 3.7 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

  49. CVE-2026-86485 3.3 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

  50. CVE-2026-86484 4.6 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

  51. CVE-2026-86483 5.4 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

  52. CVE-2026-86482 8.8 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

  53. CVE-2026-86481 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

  54. CVE-2026-86479 8.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

  55. CVE-2026-86478 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

  56. CVE-2026-75051 8.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

  57. CVE-2026-75050 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters

  58. CVE-2026-75049 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint

  59. CVE-2026-75048 8.2 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

  60. CVE-2026-75047 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint

  61. CVE-2026-75046 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint

  62. CVE-2026-75045 9.1 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

  63. CVE-2026-75044 8.1 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

  64. CVE-2026-62422 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

  65. CVE-2026-61492 6.1 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

  66. CVE-2026-59791 3.5 Faible

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

  67. CVE-2026-57926 9.8 Critique

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

  68. CVE-2026-57925 5.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

  69. CVE-2026-57924 5.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

  70. CVE-2026-57923 7.5 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

  71. CVE-2026-57922 5.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

  72. CVE-2026-57921 7.5 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

  73. CVE-2026-49386 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

  74. CVE-2026-49385 6.5 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

  75. CVE-2026-49370 7.5 Élevée

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

  76. CVE-2026-49369 4.3 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

  77. CVE-2026-49368 5.4 Moyenne

    JetBrains YouTrack

    In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible