{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "JetBrains YouTrack: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/jetbrains--youtrack/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/jetbrains--youtrack/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103493/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103493/",
   "title": "CVE-2026-103493 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible",
   "date_published": "2026-10-01T09:15:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103490/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103490/",
   "title": "CVE-2026-103490 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links",
   "date_published": "2026-10-01T09:15:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103488/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103488/",
   "title": "CVE-2026-103488 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues",
   "date_published": "2026-10-01T09:15:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100277/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100277/",
   "title": "CVE-2026-100277 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature",
   "date_published": "2026-09-30T15:17:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100273/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100273/",
   "title": "CVE-2026-100273 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution",
   "date_published": "2026-09-30T15:17:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100268/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100268/",
   "title": "CVE-2026-100268 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates",
   "date_published": "2026-09-30T15:17:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100262/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100262/",
   "title": "CVE-2026-100262 disclosed",
   "content_text": "In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates",
   "date_published": "2026-09-30T15:17:49Z"
  }
 ]
}