JetBrains YouTrack

Name: JetBrains YouTrack
Brand: JetBrains

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

4critical14high38medium1low

updated 2026-10-28

vulnerabilities (76)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-86478US	—	0.61% (49th)	Exploit	no fix	2026-09-07	2 versions
CVE-2026-75045US	—OT elevated	0.47% (40th)	Exploit	2025.3.156085, 2026.1.13913, 2026.2.18112	2026-08-17	0 → 2025.3.156085, 2026.1.13913, 2026.2.18112
CVE-2022-28648US	medium5.4	1.39% (72nd)	—	2022.1.43563	2022-04-05	2022.1.43563 → 2022.1.43563
CVE-2026-75047US	—	1.20% (68th)	—	2026.2.18177	2026-08-17	0 → 2026.2.18177
CVE-2026-75050US	medium6.5	1.06% (64th)	—	2026.1.13901, 2026.2.17950	2026-08-17	0 → 2026.1.13901, 2026.2.17950
CVE-2026-25846US	—	0.98% (62nd)	—	2025.3.119033	2026-02-09	0 → 2025.3.119033
CVE-2023-35054US	medium5.4	0.97% (62nd)	—	2023.1.10518	2023-06-12	0 → 2023.1.10518
CVE-2024-54154US	critical9.8	0.74% (54th)	—	2024.3.51866	2024-12-04	0 → 2024.3.51866
CVE-2026-61492US	medium6.1	0.66% (52nd)	—	2026.2.17394	2026-07-10	0 → 2026.2.17394
CVE-2024-50574US	high7.5	0.63% (50th)	—	2024.3.47707	2024-10-28	2 versions
CVE-2022-28650US	medium5.4	0.63% (50th)	—	2022.1.43700	2022-04-05	2022.1.43700 → 2022.1.43700
CVE-2023-35053US	high7.5	0.62% (49th)	—	2023.1.10518	2023-06-12	0 → 2023.1.10518
CVE-2026-62422US	critical9.8OT elevated	0.61% (49th)	—	2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429	2026-07-14	7 versions
CVE-2026-50242US	critical9.8OT elevated	0.61% (49th)	—	no fix	2026-06-19	6 versions
CVE-2025-24457US	medium5.5	0.60% (48th)	—	2024.3.55417	2025-01-21	2 versions
CVE-2024-54157US	medium6.5	0.60% (48th)	—	2024.3.52635	2024-12-04	2 versions
CVE-2023-38068US	high7.3	0.55% (46th)	—	2023.1.16597	2023-07-12	0 → 2023.1.16597
CVE-2024-28230US	medium6.5OT elevated	0.52% (44th)	—	2024.1.25893	2024-03-07	3 versions
CVE-2024-28229US	medium6.5OT elevated	0.52% (44th)	—	2024.1.25893	2024-03-07	3 versions
CVE-2024-28228US	medium5.3	0.48% (41st)	—	2024.1.25893	2024-03-07	3 versions
CVE-2024-49579US	medium6.1	0.45% (39th)	—	2024.3.47197	2024-10-17	2 versions
CVE-2023-50871US	medium4.3	0.45% (39th)	—	2023.3.22268	2023-12-15	2 versions
CVE-2024-38505US	high7.5	0.44% (38th)	—	2024.2.34646	2024-06-18	2 versions
CVE-2025-48391US	high7.5OT elevated	0.43% (37th)	—	2025.1.76253	2025-05-20	2 versions
CVE-2026-33392US	—	0.43% (37th)	—	2025.3.131383	2026-04-17	2 versions
CVE-2026-75044US	—OT elevated	0.42% (37th)	—	2025.3.156085, 2026.1.13914, 2026.2.18095	2026-08-17	0 → 2025.3.156085, 2026.1.13914, 2026.2.18095
CVE-2024-54155US	medium5.3OT elevated	0.42% (36th)	—	2024.3.51866	2024-12-04	2 versions
CVE-2024-22370US	medium5.4	0.41% (35th)	—	2023.3.22666	2024-01-09	2 versions
CVE-2022-28649US	medium5.4	0.40% (34th)	—	2022.1.43563	2022-04-05	2022.1.43563 → 2022.1.43563
CVE-2026-75051US	—OT elevated	0.39% (32nd)	—	2026.2.17917	2026-08-17	0 → 2026.2.17917
CVE-2025-47850US	medium5.3OT elevated	0.38% (32nd)	—	2025.1.74704	2025-05-20	2 versions
CVE-2024-50575US	medium6.1	0.38% (32nd)	—	2024.3.47707	2024-10-28	2 versions
CVE-2024-48902US	medium5.4OT elevated	0.38% (32nd)	—	2024.3.46677	2024-10-10	2 versions
CVE-2024-47160US	medium5.3OT elevated	0.37% (31st)	—	2024.3.44799	2024-09-19	2 versions
CVE-2024-54153US	medium6.5OT elevated	0.36% (30th)	—	2024.3.51866	2024-12-04	2 versions
CVE-2024-38504US	medium5.3OT elevated	0.36% (30th)	—	2024.2.34646	2024-06-18	2 versions
CVE-2024-47162US	medium5.3	0.36% (29th)	—	2024.3.44799	2024-09-19	2 versions
CVE-2024-54156US	medium6.5	0.34% (28th)	—	2024.3.52635	2024-12-04	2 versions
CVE-2026-75049US	—OT elevated	0.34% (27th)	—	2026.1.13903, 2026.2.17950	2026-08-17	0 → 2026.1.13903, 2026.2.17950
CVE-2026-57926US	critical9.8	0.34% (27th)	—	2026.2.16593	2026-06-26	0 → 2026.2.16593
CVE-2025-64684US	high7.5OT elevated	0.34% (27th)	—	2025.3.104432	2025-11-10	2 versions
CVE-2024-47159US	medium4.3OT elevated	0.33% (27th)	—	2024.3.44799	2024-09-19	2 versions
CVE-2024-50577US	medium5.4	0.33% (25th)	—	2024.3.47707	2024-10-28	2 versions
CVE-2024-50579US	medium6.1	0.32% (25th)	—	2024.3.47707	2024-10-28	2 versions
CVE-2026-75048US	—	0.32% (25th)	—	2026.2.18068	2026-08-17	0 → 2026.2.18068
CVE-2024-50582US	medium5.4	0.32% (25th)	—	2024.3.47707	2024-10-28	2 versions
CVE-2024-50581US	medium5.4	0.32% (25th)	—	2024.3.47707	2024-10-28	2 versions
CVE-2024-50580US	medium5.4	0.32% (25th)	—	2024.3.47707	2024-10-28	2 versions
CVE-2024-50578US	medium5.4	0.32% (25th)	—	2024.3.47707	2024-10-28	2 versions
CVE-2024-50576US	medium5.4	0.32% (25th)	—	2024.3.47707	2024-10-28	2 versions

showing 50 of 76

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-862Missing Authorization19 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')16 CVEs
CWE-306Missing Authentication for Critical Function6 CVEs
CWE-863Incorrect Authorization5 CVEs
CWE-290Authentication Bypass by Spoofing4 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames3 CVEs
CWE-522Insufficiently Protected Credentials3 CVEs
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')2 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)70 CVEs
RUBDU (FSTEC Data Security Threats Database)45 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan