Regular Expression Denial of Service via Mailbox Rule Filters in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

JetBrains YouTrack Server Side Request Forgery via GitHub Integration

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

YouTrack Unauthorized Notification Disclosure via iDOR in Inbox Threads

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

Unauthorized Reload of Translation Catalogs in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

Privilege Escalation via User Group Membership Changes in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

Denial of Service via Crafted PSD Attachments in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

Plain‑Text Logging of Git Credentials in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

Authenticated Sensitive Article Disclosure via Draft Creation in JetBrains YouTrack

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint

Stored XSS via Code‑Block Language Label in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

DoS via Decompression Bomb in YouTrack Import Endpoint

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint

Authenticated Account Enumeration via Users Search Endpoint in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint

Authenticated User Can Delete Arbitrary Entities via Mailbox Endpoint in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

Unauthenticated Database Backup Download via Shared Draft Signature

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

Denial of Service via Crafted Type Parameters in JetBrains YouTrack

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters

Unauthorised Project Transfer Allowance in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

Server‑Side Request Forgery via DevKit Debug Listener in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

Server‑side request forgery via OpenAPI preview proxy in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

XXE Local File Disclosure in IntelliJ IDEA Hadoop ResourceManager

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE