CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/09/2026 |
| CVE-2026-100264 | 低危2.7 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host | 30/09/2026 |
| CVE-2026-100263 | 中危6.1 | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible | 30/09/2026 |
| CVE-2026-100262 | 高危7.1 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates | 30/09/2026 |
| CVE-2026-100261 | 中危5.4 | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission | 30/09/2026 |
| CVE-2026-100260 | 中危5.3 | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset | 30/09/2026 |
| CVE-2026-100259 | 中危4.3 | In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access | 30/09/2026 |
| CVE-2026-100258 | 中危4.3 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings | 30/09/2026 |
| CVE-2026-100257 | 中危4.3 | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export | 30/09/2026 |
| CVE-2026-75051 | 高危8.1 | In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible | 17/08/2026 |
| CVE-2026-75050 | 中危6.5 | In JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type parameters | 17/08/2026 |
| CVE-2026-75049 | 中危6.5 | In JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint | 17/08/2026 |
| CVE-2026-75048 | 高危8.2 | In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible | 17/08/2026 |
| CVE-2026-75047 | 中危6.5 | In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint | 17/08/2026 |
| CVE-2026-75046 | 中危4.3 | In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint | 17/08/2026 |
| CVE-2026-75045 | 严重9.1 | In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature | 17/08/2026 |
| CVE-2026-75044 | 高危8.1 | In JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint | 17/08/2026 |