In JetBrains YouTrack before 2025.3.104432 insecure Junie configuration could lead to data exposure and unauthorized changes

In JetBrains YouTrack before 2025.3.104432 misconfiguration in the Junie could lead to exposure of the global Junie token

In JetBrains YouTrack before 2025.3.104432 missing VCS URL validation allowed delegation to unauthorized repositories from the Junie widget

In JetBrains YouTrack before 2025.3.104432 improper access control allowed modify MCP tool logic

In JetBrains YouTrack before 2025.3.104432 missing user principal cleanup led to reuse of incorrect authorization context

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations