JetBrains YouTrack vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20234
3. 202428
4. 202510
5. 202680

Newest CVEs

• CVE-2026-111092

  In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

  JetBrains · YouTrack

  Medium6.5
• CVE-2026-103497

  In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

  JetBrains · YouTrack

  Medium5.5
• CVE-2026-103496

  In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

  JetBrains · YouTrack

  Medium5.4
• CVE-2026-103495

  In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

  JetBrains · YouTrack

  Medium4.3
• CVE-2026-103494

  In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

  JetBrains · YouTrack

  Medium6.6
• CVE-2026-103493

  In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

  JetBrains · YouTrack

  High8.1
• CVE-2026-103492

  In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

  JetBrains · YouTrack

  Medium6.5
• CVE-2026-103491

  In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

  JetBrains · YouTrack

  Medium6.5
• CVE-2026-103490

  In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

  JetBrains · YouTrack

  High7.2
• CVE-2026-103489

  In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

  JetBrains · YouTrack

  Low2.0