CVE-2026-49368

MediumCVSS 5.4/10Last modified Jul 22, 2026

Description

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
JetBrainsYouTrack< 2026.1.13162

References

Timeline

Published
May 29, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-493694.3In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pagesCVE-2026-49376.0IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker CVE-2026-493707.5In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requestsCVE-2026-493718.2In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleCVE-2026-493727.5In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possibleCVE-2026-493738.8In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settingsCVE-2026-493747.6In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parametersCVE-2026-493756.1In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download pageCVE-2026-493766.5In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML pluginCVE-2026-493774.3In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersCVE-2026-493784.3In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletionCVE-2026-493796.5In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
CVE-2026-49368: Medium severity, CVSS 5.4 | Vulnix