https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-123326/https://vulnfeed.org/cve/CVE-2026-123326/Fri, 06 Nov 2026 10:28:08 +0000In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspensionhttps://vulnfeed.org/cve/CVE-2026-123327/https://vulnfeed.org/cve/CVE-2026-123327/Fri, 06 Nov 2026 10:28:08 +0000In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptionshttps://vulnfeed.org/cve/CVE-2026-123324/https://vulnfeed.org/cve/CVE-2026-123324/Fri, 06 Nov 2026 10:28:07 +0000In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possiblehttps://vulnfeed.org/cve/CVE-2026-123325/https://vulnfeed.org/cve/CVE-2026-123325/Fri, 06 Nov 2026 10:28:07 +0000In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox pagehttps://vulnfeed.org/cve/CVE-2026-123323/https://vulnfeed.org/cve/CVE-2026-123323/Fri, 06 Nov 2026 10:28:06 +0000In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation