Export limit exceeded: 384753 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (137 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-75045 1 Jetbrains 1 Youtrack 2026-08-17 9.1 Critical
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
CVE-2026-75051 1 Jetbrains 1 Youtrack 2026-08-17 8.1 High
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
CVE-2026-75046 1 Jetbrains 1 Youtrack 2026-08-17 4.3 Medium
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
CVE-2026-75050 1 Jetbrains 1 Youtrack 2026-08-17 7.1 High
In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
CVE-2026-75044 1 Jetbrains 1 Youtrack 2026-08-17 8.1 High
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
CVE-2026-75047 1 Jetbrains 1 Youtrack 2026-08-17 6.5 Medium
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
CVE-2026-75048 1 Jetbrains 1 Youtrack 2026-08-17 8.2 High
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
CVE-2026-75049 1 Jetbrains 1 Youtrack 2026-08-17 6.5 Medium
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
CVE-2026-62422 1 Jetbrains 1 Youtrack 2026-08-12 10 Critical
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVE-2026-59791 1 Jetbrains 1 Youtrack 2026-08-01 3.5 Low
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
CVE-2026-61492 1 Jetbrains 1 Youtrack 2026-08-01 3.5 Low
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
CVE-2026-57923 1 Jetbrains 1 Youtrack 2026-06-26 5.3 Medium
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
CVE-2026-57924 1 Jetbrains 1 Youtrack 2026-06-26 4.3 Medium
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVE-2026-57925 1 Jetbrains 1 Youtrack 2026-06-26 4.3 Medium
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVE-2026-57926 1 Jetbrains 1 Youtrack 2026-06-26 2.6 Low
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
CVE-2026-57921 1 Jetbrains 1 Youtrack 2026-06-26 4.3 Medium
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVE-2026-57922 1 Jetbrains 1 Youtrack 2026-06-26 3.1 Low
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVE-2026-49368 1 Jetbrains 1 Youtrack 2026-06-01 8.7 High
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
CVE-2026-49369 1 Jetbrains 1 Youtrack 2026-06-01 4.3 Medium
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
CVE-2026-49370 1 Jetbrains 1 Youtrack 2026-06-01 3.4 Low
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests