Jetbrains Youtrack vulnerabilities
180 vulnerabilities
Known vulnerabilities in Jetbrains Youtrack, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-111092jetbrainsyoutrack
EPSS score0.27%
In JetBrains YouTrack before 2026.2.19575
2026.3.16075
2026.3.16397
2026.3.16402 mail rules allowed a project admin to execute cross-project issue commandsCVE-2021-31905jetbrainsyoutrackEPSS score1.88%
In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.CVE-2021-31903jetbrainsyoutrackEPSS score0.78%
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.CVE-2021-31902jetbrainsyoutrackEPSS score1.19%
In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.CVE-2021-25771jetbrainsyoutrackEPSS score1.55%
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.CVE-2021-25768jetbrainsyoutrackEPSS score1.18%
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.CVE-2021-25767jetbrainsyoutrackEPSS score2.56%
In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.CVE-2021-25769jetbrainsyoutrackEPSS score1.77%
In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.CVE-2021-25765jetbrainsyoutrackEPSS score0.71%
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.CVE-2021-25770jetbrainsyoutrackEPSS score3.47%
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.CVE-2021-25766jetbrainsyoutrackEPSS score1.43%
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.CVE-2021-37550jetbrainsyoutrackEPSS score1.13%
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.CVE-2021-37549jetbrainsyoutrackEPSS score1.35%
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.CVE-2021-37551jetbrainsyoutrackEPSS score0.70%
In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.CVE-2021-37554jetbrainsyoutrackEPSS score0.88%
In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.CVE-2021-37552jetbrainsyoutrackEPSS score0.62%
In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.CVE-2021-37553jetbrainsyoutrackEPSS score1.45%
In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.CVE-2021-43184jetbrainsyoutrackEPSS score0.66%
In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.CVE-2021-43186jetbrainsyoutrackEPSS score0.56%
JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.CVE-2021-43185jetbrainsyoutrackEPSS score2.01%
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.