Youtrack
147 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Youtrack, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
Youtrack CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 11 |
| 2024-11 | 0 |
| 2024-12 | 6 |
| 2025-01 | 2 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 2 |
| 2025-06 | 0 |
| 2025-07 | 2 |
| 2025-08 | 1 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 3 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 2 |
| 2026-03 | 0 |
| 2026-04 | 1 |
| 2026-05 | 5 |
| 2026-06 | 6 |
| 2026-07 | 3 |
| 2026-08 | 8 |
| 2026-09 | 22 |
Severity
How the 147 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical11
- High34
- Medium87
- Low15
Latest CVEs
The 15 most recently published vulnerabilities affecting Youtrack.
- CVE-2026-86500In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin5.5
- CVE-2026-86499In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission4.3
- CVE-2026-86498In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission7.7
- CVE-2026-86496In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses4.3
- CVE-2026-86495In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects6.5
- CVE-2026-86497In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials6.8
- CVE-2026-86493In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards6.5
- CVE-2026-86492In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens8.5
- CVE-2026-86494In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues7.7
- CVE-2026-86489In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations6.5
- CVE-2026-86490In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint6.5
- CVE-2026-86491In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads3.5
- CVE-2026-86487In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content3.1
- CVE-2026-86488In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches6.5
- CVE-2026-86485In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks3.3
Product grouping is registry-driven, with AI assist and human review. How it works