Known vulnerabilities in YouTrack

Vendor: JetBrains s.r.o.
Software: YouTrack
Software CPE: cpe:2.3:a:jetbrains_s.r.o.:youtrack:*:*:*:*:*:*:*:*
Website: https://www.jetbrains.com/
Total vulnerabilities: 70
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting YouTrack YouTrack is affected by 70 known vulnerabilities: 1 critical, 2 high, 26 medium, 41 low Critical High Medium Low

Vulnerabilities (70)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU143876 - Missing Authorization
CVE-2026-75051		 CWE-862 Low
No
No
 2026.2.17917 17.08.2026 SB20260817110
#VU143875 - Allocation of Resources Without Limits or Throttling
CVE-2026-75050		 CWE-770 Medium
No
No
 2026.1.13901, 2026.2.17950 17.08.2026 SB20260817109
#VU143874 - Missing Authorization
CVE-2026-75049		 CWE-862 Low
No
No
 2026.1.13903, 2026.2.17950 17.08.2026 SB20260817109
#VU143873 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-75048		 CWE-79 Low
No
No
 2026.2.18068 17.08.2026 SB20260817108
#VU143872 - Improper Handling of Highly Compressed Data (Data Amplification)
CVE-2026-75047		 CWE-409 Medium
No
No
 2026.2.18177 17.08.2026 SB20260817107
#VU143871 - Missing Authorization
CVE-2026-75046		 CWE-862 Low
No
No
 2026.2.18112 17.08.2026 SB20260817104
#VU143870 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-75045		 CWE-288 Medium
No
No
 2025.3.156085, 2026.1.13913, 2026.2.18112 17.08.2026 SB20260817104
#VU143861 - Missing Authorization
CVE-2026-75044		 CWE-862 Low
No
No
 2025.3.156085, 2026.1.13914, 2026.2.18095 17.08.2026 SB20260817104
#VU143847 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-61492		 CWE-79 Low
No
No
 2026.2.17394 17.08.2026 SB20260817100
#VU143842 - Improper Restriction of Rendered UI Layers or Frames
CVE-2026-59791		 CWE-1021 Low
No
No
 2026.2.17012 17.08.2026 SB2026081798
#VU143840 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-57926		 CWE-1321 Medium
No
No
 2026.2.16593 17.08.2026 SB2026081796
#VU143839 - Missing Authorization
CVE-2026-57925		 CWE-862 Low
No
No
 2026.2.16593 17.08.2026 SB2026081796
#VU143838 - Incorrect Default Permissions
CVE-2026-57924		 CWE-276 Low
No
No
 2026.2.16593 17.08.2026 SB2026081796
#VU143837 - Missing Authorization
CVE-2026-57923		 CWE-862 Low
No
No
 2026.2.16593 17.08.2026 SB2026081796
#VU143836 - Missing Authorization
CVE-2026-57922		 CWE-862 Low
No
No
 2026.2.16593 17.08.2026 SB2026081796
#VU143835 - Missing Authorization
CVE-2026-57921		 CWE-862 Low
No
No
 2026.2.16593 17.08.2026 SB2026081796
#VU143830 - Missing Authentication for Critical Function
CVE-2026-62422		 CWE-306 Low
No
No
 2024.2.148429, 2024.3.148430, 2025.1.148120, 2025.2.148048, 2025.3.148033, 2026.1.13757 17.08.2026 SB2026081793
#VU143826 - Insertion of Sensitive Information Into Sent Data
CVE-2026-49370		 CWE-201 Medium
No
No
 2026.1.13162 17.08.2026 SB2026081791
#VU143825 - Incorrect Authorization
CVE-2026-49369		 CWE-863 Low
No
No
 2026.1.13162 17.08.2026 SB2026081791
#VU143824 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-49368		 CWE-79 Low
No
No
 2026.1.13162 17.08.2026 SB2026081791


Showing elements 1 - 20 out of 70