Threat database

1,404 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.9	EPSS 0.2%	CVE-2026-100276JetBrains YouTrack · Incorrect Authorization Medium5.9EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100276 In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action EPSS 0.2%Vulnerability CWE-863	CVE Database V5	2026-09-30
Medium	6.9	EPSS 0.2%	CVE-2026-100275JetBrains YouTrack · Cross-site Scripting Medium6.9EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100275 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.8%	CVE-2026-100274JetBrains YouTrack · Unthrottled Resource Allocation Medium6.5EPSS 0.8%2026-09-30CVE Database V5CVE-2026-100274 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template EPSS 0.8%Vulnerability CWE-770	CVE Database V5	2026-09-30
High	8.2	EPSS 0.3%	CVE-2026-100273JetBrains YouTrack · Incorrect Authorization High8.2EPSS 0.3%2026-09-30CVE Database V5CVE-2026-100273 CVE-2026-100273 is a high-severity vulnerability in JetBrains YouTrack before version 2026.2.19197. It involves an authorization bypass in the scripts debugger component that allows arbitrary code execution. The vulnerability has a CVSS score of 8.2, indicating significant impact on confidentiality and integrity. No official patch link is provided in the data, and the product is not a cloud service. There are no known exploits in the wild at this time. EPSS 0.3%Vulnerability CWE-863	CVE Database V5	2026-09-30
Medium	4.9	EPSS 0.3%	CVE-2026-100272JetBrains YouTrack · Insecure Direct Object Reference Medium4.9EPSS 0.3%2026-09-30CVE Database V5CVE-2026-100272 In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues EPSS 0.3%Vulnerability CWE-639	CVE Database V5	2026-09-30
Low	2.7	EPSS 0.2%	CVE-2026-100271JetBrains YouTrack · Missing Authorization Low2.7EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100271 In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects EPSS 0.2%Vulnerability CWE-862	CVE Database V5	2026-09-30
Low	3.3	EPSS 0.2%	CVE-2026-100270JetBrains YouTrack · Incorrect Authorization Low3.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100270 In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations EPSS 0.2%Vulnerability CWE-863	CVE Database V5	2026-09-30
Medium	4.3	EPSS 0.2%	CVE-2026-100269JetBrains YouTrack · Missing Authorization Medium4.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100269 In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed EPSS 0.2%Vulnerability CWE-862	CVE Database V5	2026-09-30
High	7.7	EPSS 0.2%	CVE-2026-100268JetBrains YouTrack · Insecure Direct Object Reference High7.7EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100268 In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates EPSS 0.2%Vulnerability CWE-639	CVE Database V5	2026-09-30
Medium	5.9	EPSS 0.3%	CVE-2026-100267JetBrains YouTrack · ReDoS Medium5.9EPSS 0.3%2026-09-30CVE Database V5CVE-2026-100267 In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters EPSS 0.3%Vulnerability CWE-1333	CVE Database V5	2026-09-30
High	7.7	EPSS 0.2%	CVE-2026-100266JetBrains Hub · Missing Authorization High7.7EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address EPSS 0.2%Vulnerability CWE-862	CVE Database V5	2026-09-30
Medium	4.8	EPSS 0.1%	CVE-2026-100265JetBrains Rider · CWE-494 Medium4.8EPSS 0.1%2026-09-30CVE Database V5CVE-2026-100265 In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation EPSS 0.1%Vulnerability CWE-494	CVE Database V5	2026-09-30
Low	2.7	EPSS 0.2%	CVE-2026-100264JetBrains YouTrack · CWE-522 Low2.7EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100264 In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host EPSS 0.2%Vulnerability CWE-522	CVE Database V5	2026-09-30
Medium	4.7	EPSS 0.2%	CVE-2026-100263JetBrains YouTrack · Cross-site Scripting Medium4.7EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100263 In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-09-30
High	7.6	EPSS 0.2%	CVE-2026-100262JetBrains YouTrack · Incorrect Authorization High7.6EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100262 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates EPSS 0.2%Vulnerability CWE-863	CVE Database V5	2026-09-30
Medium	5.4	EPSS 0.2%	CVE-2026-100261JetBrains YouTrack · CWE-288 Medium5.4EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100261 In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission EPSS 0.2%Vulnerability CWE-288	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.3%	CVE-2026-100260JetBrains YouTrack · Insecure Default Medium5.3EPSS 0.3%2026-09-30CVE Database V5CVE-2026-100260 In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset EPSS 0.3%Vulnerability CWE-1188	CVE Database V5	2026-09-30
Medium	4.3	EPSS 0.2%	CVE-2026-100259JetBrains YouTrack · Incorrect Authorization Medium4.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100259 In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access EPSS 0.2%Vulnerability CWE-863	CVE Database V5	2026-09-30
Medium	4.3	EPSS 0.7%	CVE-2026-100258JetBrains YouTrack · CWE-201 Medium4.3EPSS 0.7%2026-09-30CVE Database V5CVE-2026-100258 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings EPSS 0.7%Vulnerability CWE-201	CVE Database V5	2026-09-30
Medium	4.3	EPSS 0.2%	CVE-2026-100257JetBrains YouTrack · Server-Side Request Forgery Medium4.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100257 In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export EPSS 0.2%Vulnerability CWE-918	CVE Database V5	2026-09-30

Page 18 of 72