CVE-2026-103493

HighCVSS 8.1/10Last modified Oct 1, 2026

Description

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1034946.6In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changesCVE-2026-1034954.3In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogsCVE-2026-1034965.4In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notificationsCVE-2026-1034975.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationCVE-2026-1034997.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow CVE-2026-10353.1A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing reCVE-2026-1035006.1An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulneraCVE-2026-1035019.8Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in CVE-2026-1035025.9Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pmCVE-2026-1035035.9Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate fCVE-2026-1035048.1Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and CVE-2026-1035056.5Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3
CVE-2026-103493: High severity, CVSS 8.1 | Vulnix