VendorsJetBrainsyoutrackall versions
Vulnerabilities

JetBrains YouTrack

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

157CVEs
CVE-2021-31903
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.
Published 2021-05-11 · Modified
6.1EPSS 0.008
CVE-2026-61492
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
Published 2026-07-10 · Analyzed
6.1EPSS 0.007
CVE-2024-50575
In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API
Published 2024-10-28 · Analyzed
6.1EPSS 0.004
CVE-2024-50579
In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible
Published 2024-10-28 · Analyzed
6.1EPSS 0.003
CVE-2025-54527
In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions
Published 2025-07-28 · Analyzed
6.1EPSS 0.003
CVE-2026-100263
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
Published 2026-09-30 · Analyzed
6.1EPSS 0.002
CVE-2026-100267
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
Published 2026-09-30 · Analyzed
5.9EPSS 0.003
CVE-2022-28648
In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered
Published 2022-04-05 · Modified
5.7EPSS 0.014
CVE-2025-24457
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
Published 2025-01-21 · Analyzed
5.5EPSS 0.006
CVE-2026-103497
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
Published 2026-10-01 · Analyzed
5.5EPSS 0.002
CVE-2023-35054
In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible
Published 2023-06-12 · Modified
5.4EPSS 0.010
CVE-2021-43184
In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
Published 2021-11-09 · Modified
5.4EPSS 0.007
CVE-2021-37552
In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.
Published 2021-08-06 · Modified
5.4EPSS 0.006
CVE-2021-27733
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.
Published 2021-05-11 · Modified
5.4EPSS 0.006
CVE-2021-43186
JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.
Published 2021-11-09 · Modified
5.4EPSS 0.006
CVE-2022-24344
JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
Published 2022-02-25 · Modified
5.4EPSS 0.006
CVE-2022-24347
JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
Published 2022-02-25 · Modified
5.4EPSS 0.006
CVE-2024-22370
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
Published 2024-01-09 · Modified
5.4EPSS 0.004
CVE-2022-28649
In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description
Published 2022-04-05 · Modified
5.4EPSS 0.004
CVE-2024-48902
In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API
Published 2024-10-10 · Analyzed
5.4EPSS 0.004
CVE-2026-103489
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
Published 2026-10-01 · Analyzed
5.4EPSS 0.003
CVE-2024-50577
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings
Published 2024-10-28 · Analyzed
5.4EPSS 0.003
CVE-2024-50576
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest
Published 2024-10-28 · Analyzed
5.4EPSS 0.003
CVE-2024-50578
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page
Published 2024-10-28 · Analyzed
5.4EPSS 0.003
CVE-2024-50580
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule
Published 2024-10-28 · Analyzed
5.4EPSS 0.003
CVE-2024-50581
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag
Published 2024-10-28 · Analyzed
5.4EPSS 0.003
CVE-2024-50582
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
Published 2024-10-28 · Analyzed
5.4EPSS 0.003
CVE-2026-100261
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
Published 2026-09-30 · Analyzed
5.4EPSS 0.002
CVE-2026-103496
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
Published 2026-10-01 · Analyzed
5.4EPSS 0.001
CVE-2021-25767
In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
Published 2021-02-03 · Modified
5.3EPSS 0.027
CVE-2020-7912
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
Published 2020-01-30 · Modified
5.3EPSS 0.015
CVE-2020-15818
In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.
Published 2020-08-08 · Modified
5.3EPSS 0.014
CVE-2020-15820
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
Published 2020-08-08 · Modified
5.3EPSS 0.014
CVE-2020-25210
In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.
Published 2020-11-16 · Modified
5.3EPSS 0.014
CVE-2021-25766
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
Published 2021-02-03 · Modified
5.3EPSS 0.014
CVE-2020-15819
JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.
Published 2020-08-08 · Modified
5.3EPSS 0.014
CVE-2020-27625
In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.
Published 2020-11-16 · Modified
5.3EPSS 0.014
CVE-2020-27624
JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.
Published 2020-11-16 · Modified
5.3EPSS 0.014
CVE-2020-25208
In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.
Published 2021-02-03 · Modified
5.3EPSS 0.014
CVE-2020-27626
JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.
Published 2020-11-16 · Modified
5.3EPSS 0.013
← Prev3 / 4Next →