jetbrains ktor

Name: jetbrains ktor
Brand: jetbrains

productUS

cpe:2.3:a:jetbrains:ktor:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

3critical4high11medium2low

updated 2026-10-28

vulnerabilities (21)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-45612US	critical9.8	0.71% (53rd)	Exploit	2.3.5	2023-10-09	< 2.3.5
CVE-2019-12736US	critical9.8	2.22% (83rd)	—	no fix	2019-10-02	≤ 1.1.5
CVE-2022-29930US	medium4.9OT elevated	0.89% (59th)	—	no fix	2022-05-12	= 2.0.0
CVE-2021-43203US	high7.5	0.86% (58th)	—	1.6.4	2021-11-09	< 1.6.4
CVE-2019-19389US	medium5.4	0.83% (57th)	—	1.2.6	2019-12-26	< 1.2.6
CVE-2019-10102US	high8.1OT elevated	0.82% (57th)	—	1.1.0	2019-07-03	< 1.1.0
CVE-2021-25762US	medium5.3	0.81% (57th)	—	1.4.3	2021-02-03	< 1.4.3
CVE-2020-26129US	medium6.5	0.77% (55th)	—	1.4.1	2020-11-16	< 1.4.1
CVE-2020-5207US	high7.5	0.76% (55th)	—	1.3.0	2020-01-27	< 1.3.0
CVE-2022-48476US	high7.5	0.75% (55th)	—	2.3.0	2023-04-24	< 2.3.0
CVE-2022-38180US	medium6.5	0.73% (54th)	—	2.1.0	2022-08-12	< 2.1.0
CVE-2019-12737US	medium5.3	0.68% (52nd)	—	no fix	2019-10-02	2 versions
CVE-2019-19703US	medium6.1	0.64% (51st)	—	no fix	2019-12-10	≤ 1.2.6
CVE-2022-29035US	low2.7OT elevated	0.62% (50th)	—	2.0.0	2022-04-11	< 2.0.0
CVE-2021-25763US	medium5.3OT elevated	0.54% (45th)	—	1.4.2	2021-02-03	< 1.4.2
CVE-2021-25761US	medium5.3	0.54% (45th)	—	1.5.0	2021-02-03	< 1.5.0
CVE-2022-38179US	medium6.1	0.48% (41st)	—	2.1.0	2022-08-12	< 2.1.0
CVE-2024-49580US	medium5.3	0.35% (29th)	—	3.0.0	2024-10-17	< 3.0.0
CVE-2023-45613US	critical9.1	0.35% (28th)	—	2.3.5	2023-10-09	< 2.3.5
CVE-2025-29904US	—	0.33% (26th)	—	3.1.1	2025-03-12	< 3.1.1
CVE-2023-34339US	low3.3	0.21% (11th)	—	2.3.1	2023-06-01	< 2.3.1

The flaw types (CWEs) most of these CVEs share.

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')4 CVEs
CWE-287Improper Authentication2 CVEs
CWE-330Use of Insufficiently Random Values2 CVEs
CWE-184Incomplete List of Disallowed Inputs1 CVEs
CWE-209Generation of Error Message Containing Sensitive Information1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-295Improper Certificate Validation1 CVEs
CWE-319Cleartext Transmission of Sensitive Information1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.