{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "JetBrains YouTrack: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/jetbrains--youtrack/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/jetbrains--youtrack/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111092/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111092/",
   "title": "CVE-2026-111092 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19575\n2026.3.16075\n2026.3.16397\n2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands",
   "date_published": "2026-10-15T15:29:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103497/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103497/",
   "title": "CVE-2026-103497 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration",
   "date_published": "2026-10-01T09:15:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103496/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103496/",
   "title": "CVE-2026-103496 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications",
   "date_published": "2026-10-01T09:15:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103495/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103495/",
   "title": "CVE-2026-103495 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs",
   "date_published": "2026-10-01T09:15:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103494/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103494/",
   "title": "CVE-2026-103494 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes",
   "date_published": "2026-10-01T09:15:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103493/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103493/",
   "title": "CVE-2026-103493 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible",
   "date_published": "2026-10-01T09:15:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103492/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103492/",
   "title": "CVE-2026-103492 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments",
   "date_published": "2026-10-01T09:15:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103491/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103491/",
   "title": "CVE-2026-103491 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues",
   "date_published": "2026-10-01T09:15:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103490/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103490/",
   "title": "CVE-2026-103490 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links",
   "date_published": "2026-10-01T09:15:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103489/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103489/",
   "title": "CVE-2026-103489 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible",
   "date_published": "2026-10-01T09:15:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103488/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103488/",
   "title": "CVE-2026-103488 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues",
   "date_published": "2026-10-01T09:15:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100280/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100280/",
   "title": "CVE-2026-100280 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible",
   "date_published": "2026-09-30T15:17:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100279/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100279/",
   "title": "CVE-2026-100279 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials",
   "date_published": "2026-09-30T15:17:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100278/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100278/",
   "title": "CVE-2026-100278 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments",
   "date_published": "2026-09-30T15:17:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100277/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100277/",
   "title": "CVE-2026-100277 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature",
   "date_published": "2026-09-30T15:17:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100276/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100276/",
   "title": "CVE-2026-100276 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action",
   "date_published": "2026-09-30T15:17:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100275/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100275/",
   "title": "CVE-2026-100275 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible",
   "date_published": "2026-09-30T15:17:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100274/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100274/",
   "title": "CVE-2026-100274 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template",
   "date_published": "2026-09-30T15:17:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100273/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100273/",
   "title": "CVE-2026-100273 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution",
   "date_published": "2026-09-30T15:17:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100272/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100272/",
   "title": "CVE-2026-100272 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues",
   "date_published": "2026-09-30T15:17:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100271/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100271/",
   "title": "CVE-2026-100271 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects",
   "date_published": "2026-09-30T15:17:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100270/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100270/",
   "title": "CVE-2026-100270 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations",
   "date_published": "2026-09-30T15:17:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100269/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100269/",
   "title": "CVE-2026-100269 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed",
   "date_published": "2026-09-30T15:17:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100268/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100268/",
   "title": "CVE-2026-100268 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates",
   "date_published": "2026-09-30T15:17:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100267/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100267/",
   "title": "CVE-2026-100267 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters",
   "date_published": "2026-09-30T15:17:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100264/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100264/",
   "title": "CVE-2026-100264 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host",
   "date_published": "2026-09-30T15:17:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100263/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100263/",
   "title": "CVE-2026-100263 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible",
   "date_published": "2026-09-30T15:17:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100262/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100262/",
   "title": "CVE-2026-100262 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates",
   "date_published": "2026-09-30T15:17:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100261/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100261/",
   "title": "CVE-2026-100261 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission",
   "date_published": "2026-09-30T15:17:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100260/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100260/",
   "title": "CVE-2026-100260 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset",
   "date_published": "2026-09-30T15:17:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100259/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100259/",
   "title": "CVE-2026-100259 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access",
   "date_published": "2026-09-30T15:17:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100258/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100258/",
   "title": "CVE-2026-100258 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings",
   "date_published": "2026-09-30T15:17:47Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100257/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100257/",
   "title": "CVE-2026-100257 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export",
   "date_published": "2026-09-30T15:17:46Z"
  }
 ]
}