CVE Tools
Track your stack

Youtrack

196 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Youtrack, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Youtrack CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Youtrack CVEs per month
MonthCVEs
2024-126
2025-012
2025-020
2025-030
2025-040
2025-052
2025-060
2025-072
2025-081
2025-090
2025-100
2025-113
2025-120
2026-010
2026-022
2026-030
2026-041
2026-055
2026-066
2026-073
2026-088
2026-0944
2026-1011
2026-1116

Severity

How the 196 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical116%
  • High4623%
  • Medium11358%
  • Low2613%

Latest CVEs

The 15 most recently published vulnerabilities affecting Youtrack.

  1. CVE-2026-123850In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives3.5
  2. CVE-2026-123337In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility3.1
  3. CVE-2026-123335In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection3.5
  4. CVE-2026-123336In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion3.1
  5. CVE-2026-123334In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project3.8
  6. CVE-2026-123333In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints3.8
  7. CVE-2026-123332In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations4.7
  8. CVE-2026-123330In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings5.4
  9. CVE-2026-123329In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions5.4
  10. CVE-2026-123331In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles5.4
  11. CVE-2026-123326In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension7.1
  12. CVE-2026-123328In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab6.4
  13. CVE-2026-123327In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions7.5
  14. CVE-2026-123325In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page7.1
  15. CVE-2026-123324In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible7.7

Product grouping is registry-driven, with AI assist and human review. How it works