CVE-2026-123336Low· 3.1▾ SunlitIn JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
YouTrack < 2026.2.19728Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100274Medium· 6.5In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
CVE-2026-75050High· 7.1In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
CVE-2026-123850Low· 3.5In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
CVE-2026-123323High· 8.4In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
CVE-2026-123324High· 7.7In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
CVE-2026-123325High· 7.1In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page