Known vulnerabilities in YouTrack

Vendor: JetBrains s.r.o.
Software: YouTrack
Software CPE: cpe:2.3:a:jetbrains_s.r.o.:youtrack:*:*:*:*:*:*:*:*
Website: https://www.jetbrains.com/
Total vulnerabilities: 124
Public exploits: 3
Known exploited (KEV): 1

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting YouTrack YouTrack is affected by 124 known vulnerabilities: 1 critical, 3 high, 41 medium, 79 low Critical High Medium Low

Vulnerabilities (124)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU147350 - Authorization Bypass Through User-Controlled Key
CVE-2026-86489		 CWE-639 Medium
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147349 - Incorrect Authorization
CVE-2026-86490		 CWE-863 Low
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147348 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-86491		 CWE-79 Low
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147347 - Exposure of Data Element to Wrong Session
CVE-2026-86492		 CWE-488 Low
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147346 - Incorrect Authorization
CVE-2026-86493		 CWE-863 Low
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147345 - Missing Authorization
CVE-2026-86494		 CWE-862 Low
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147344 - Missing Authorization
CVE-2026-86495		 CWE-862 Low
No
No
 2026.2.18687 07.09.2026 SB20260907141
#VU147343 - Missing Authorization
CVE-2026-86496		 CWE-862 Low
No
No
 2026.2.18769 07.09.2026 SB20260907140
#VU147342 - Insertion of Sensitive Information Into Sent Data
CVE-2026-86497		 CWE-201 Low
No
No
 2026.2.18769 07.09.2026 SB20260907140
#VU147341 - Incorrect Authorization
CVE-2026-86498		 CWE-863 Low
No
No
 2025.3.160480, 2026.1.14047 07.09.2026 SB20260907139
#VU147340 - Missing Authorization
CVE-2026-86499		 CWE-862 Low
No
No
 2026.1.14047 07.09.2026 SB20260907139
#VU147339 - Incorrect Privilege Assignment
CVE-2026-86500		 CWE-266 Low
No
No
 2026.1.14047 07.09.2026 SB20260907139
#VU147338 - Authentication Bypass by Spoofing
CVE-2026-86478		 CWE-290 High
No
No
 2025.3.161254, 2026.1.14042 07.09.2026 SB20260907136
#VU147331 - Missing Authorization
CVE-2026-86479		 CWE-862 Low
No
No
 2025.3.161254, 2026.1.14055, 2026.2.18788 07.09.2026 SB20260907136
#VU147330 - Authorization Bypass Through User-Controlled Key
CVE-2026-86481		 CWE-639 Medium
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147329 - Incorrect Privilege Assignment
CVE-2026-86482		 CWE-266 Low
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147328 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-86483		 CWE-79 Low
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147327 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-86484		 CWE-79 Medium
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147326 - Reliance on IP Address for Authentication
CVE-2026-86485		 CWE-291 Medium
No
No
 2026.2.18634 07.09.2026 SB20260907135
#VU147325 - Missing Authentication for Critical Function
CVE-2026-86486		 CWE-306 Medium
No
No
 2026.2.18634 07.09.2026 SB20260907135


Showing elements 1 - 20 out of 124