Export limit exceeded: 387296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 387296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (159 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86499 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 4.3 Medium |
| In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission | ||||
| CVE-2026-86492 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 8.5 High |
| In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens | ||||
| CVE-2026-86493 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards | ||||
| CVE-2026-86481 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 4.3 Medium |
| In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons | ||||
| CVE-2026-86483 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 5.4 Medium |
| In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible | ||||
| CVE-2026-86486 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 3.7 Low |
| In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank | ||||
| CVE-2026-86494 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 7.7 High |
| In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues | ||||
| CVE-2026-86495 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects | ||||
| CVE-2026-86491 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads | ||||
| CVE-2026-86498 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 7.7 High |
| In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission | ||||
| CVE-2026-86478 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 9.8 Critical |
| In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address | ||||
| CVE-2026-86479 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 8 High |
| In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR | ||||
| CVE-2026-86482 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 8.8 High |
| In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation | ||||
| CVE-2026-86484 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 4.6 Medium |
| In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS | ||||
| CVE-2026-86500 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 5.5 Medium |
| In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin | ||||
| CVE-2026-86496 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 4.3 Medium |
| In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses | ||||
| CVE-2026-86497 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 6.8 Medium |
| In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials | ||||
| CVE-2026-86485 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks | ||||
| CVE-2026-86487 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content | ||||
| CVE-2026-86488 | 1 Jetbrains | 1 Youtrack | 2026-09-07 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches | ||||