JetBrains / Hub
37 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-100266 | In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address | HIGH | 7.7 | Sep 30, 2026 |
| CVE-2026-86480 | In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges | CRITICAL | 9.8 | Sep 7, 2026 |
| CVE-2026-50242 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database acces… | CRITICAL | 10.0 | Jun 19, 2026 |
| CVE-2026-56142 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authenticatio… | CRITICAL | 9.6 | Jun 19, 2026 |
| CVE-2026-56141 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes… | CRITICAL | 9.8 | Jun 19, 2026 |
| CVE-2026-32229 | In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled | MEDIUM | 6.8 | Mar 11, 2026 |
| CVE-2026-25848 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible | CRITICAL | 9.8 | Feb 9, 2026 |
| CVE-2025-64683 | In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API | HIGH | 7.5 | Nov 10, 2025 |
| CVE-2025-64682 | In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit | LOW | 3.7 | Nov 10, 2025 |
| CVE-2025-64681 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations | LOW | 3.7 | Nov 10, 2025 |
| CVE-2025-24456 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping | HIGH | 8.8 | Jan 21, 2025 |
| CVE-2024-50573 | In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services | MEDIUM | 5.4 | Oct 28, 2024 |
| CVE-2024-38507 | In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible | MEDIUM | 5.4 | Jun 18, 2024 |
| CVE-2022-48477 | In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing | CRITICAL | 9.8 | Apr 24, 2023 |
| CVE-2022-48429 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible | MEDIUM | 5.4 | Mar 27, 2023 |
| CVE-2022-45471 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address | HIGH | 7.5 | Nov 18, 2022 |
| CVE-2022-34894 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services | MEDIUM | 5.3 | Jul 1, 2022 |
| CVE-2022-29811 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. | MEDIUM | 6.1 | Apr 28, 2022 |
| CVE-2022-25259 | JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. | MEDIUM | 6.1 | Feb 25, 2022 |
| CVE-2022-25260 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). | CRITICAL | 9.1 | Feb 25, 2022 |
| CVE-2022-25262 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. | CRITICAL | 9.8 | Feb 25, 2022 |
| CVE-2022-24328 | In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. | MEDIUM | 6.5 | Feb 25, 2022 |
| CVE-2022-24327 | In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. | HIGH | 7.5 | Feb 25, 2022 |
| CVE-2021-43180 | In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. | HIGH | 7.5 | Nov 9, 2021 |
| CVE-2021-43182 | In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. | HIGH | 7.5 | Nov 9, 2021 |
Showing 1 to 25 of 37 CVEs