Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
189 results · page 2 of 4
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possibleCVE-2026-86483 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalationCVE-2026-86482 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project iconsCVE-2026-86481 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDORCVE-2026-86479 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserCVE-2026-86478 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.8
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possibleCVE-2026-75051 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parametersCVE-2026-75050 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoinCVE-2026-75049 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possibleCVE-2026-75048 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.2
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointCVE-2026-75047 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpointCVE-2026-75046 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signatureCVE-2026-75045 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.1
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via thCVE-2026-75044 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database aCVE-2026-62422 · Other software · JetBrains · reported by cve@jetbrains.comCritical 10
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possibleCVE-2026-61492 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possibleCVE-2026-59791 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attackCVE-2026-57926 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.6
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tagsCVE-2026-57925 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile detailsCVE-2026-57924 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settingsCVE-2026-57923 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possibleCVE-2026-57922 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpointCVE-2026-57921 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning CanvasCVE-2026-49386 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accountsCVE-2026-49385 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requestsCVE-2026-49370 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.4
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pagesCVE-2026-49369 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possibleCVE-2026-49368 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.7
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypassCVE-2026-33392 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.2
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpointCVE-2026-28193 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logsCVE-2026-25846 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limitCVE-2025-64773 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosureCVE-2025-64685 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback formCVE-2025-64684 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram contentCVE-2025-57731 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.7
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass sCVE-2025-54527 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possibleCVE-2025-53959 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.6
In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in APICVE-2025-48391 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possibleCVE-2025-47852 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloningCVE-2025-47850 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integrationCVE-2025-24458 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logsCVE-2025-24457 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encodingCVE-2024-54158 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detectorCVE-2024-54157 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attackCVE-2024-54156 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.2
In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authenticationCVE-2024-54155 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.7
In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandboxCVE-2024-54154 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameterCVE-2024-54153 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elementsCVE-2024-50582 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tagCVE-2024-50581 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering ruleCVE-2024-50580 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.