cve.bz

jetbrains hub vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 2.7CVE-2026-123300EPSS 0.3%

    In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

  2. 3.1CVE-2026-123299EPSS 0.2%

    In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

  3. 5.0CVE-2026-123298EPSS 0.6%

    In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

  4. 6.8CVE-2026-123297EPSS 0.3%

    In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

  5. 7.5CVE-2026-123296EPSS 0.3%

    In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

  6. 8.1CVE-2026-123295EPSS 0.4%

    In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

  7. 9.6CVE-2026-123294EPSS 0.4%

    In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

  8. 6.5CVE-2026-100266EPSS 0.2%

    In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

  9. 9.8CVE-2026-86480EPSS 0.6%

    In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

  10. 8.8CVE-2026-56142EPSS 0.6%

    In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

  11. 9.8CVE-2026-56141EPSS 0.5%

    In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

  12. 9.8CVE-2026-50242EPSS 0.6%

    In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

  13. 6.8CVE-2026-32229EPSS 0.2%

    In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

  14. 9.8CVE-2026-25848EPSS 0.5%

    In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

  15. 7.5CVE-2025-64683EPSS 0.2%

    In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

  16. 3.7CVE-2025-64682EPSS 0.2%

    In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

  17. 3.7CVE-2025-64681EPSS 0.2%

    In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations

  18. 8.8CVE-2025-24456EPSS 0.3%

    In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping

  19. 5.4CVE-2024-50573EPSS 0.2%

    In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services

  20. 5.4CVE-2024-38507EPSS 0.2%

    In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible

  21. 9.8CVE-2022-48477EPSS 0.5%

    In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

  22. 5.4CVE-2022-48429EPSS 0.6%

    In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

  23. 7.5CVE-2022-45471EPSS 0.6%

    In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

  24. 5.3CVE-2022-34894EPSS 0.6%

    In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services

  25. 4.8CVE-2022-29811EPSS 0.5%

    In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

  26. 9.8CVE-2022-25262EPSS 1.5%

    In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

  27. 9.1CVE-2022-25260EPSS 2.4%

    JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

  28. 6.1CVE-2022-25259EPSS 0.6%

    JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

  29. 6.5CVE-2022-24328EPSS 0.8%

    In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.

  30. 7.5CVE-2022-24327EPSS 0.9%

    In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.

  31. 7.5CVE-2021-43182EPSS 1.0%

    In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.

  32. 6.1CVE-2021-43181EPSS 0.6%

    In JetBrains Hub before 2021.1.13690, stored XSS is possible.

  33. 7.5CVE-2021-43180EPSS 1.0%

    In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.

  34. 9.8CVE-2021-43183EPSS 1.2%

    In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.

  35. 6.1CVE-2021-37541EPSS 0.5%

    In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.

  36. 6.5CVE-2021-37540EPSS 0.7%

    In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.

  37. 9.8CVE-2021-36209EPSS 1.0%

    In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.

  38. 7.5CVE-2021-31901EPSS 0.9%

    In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.

  39. 5.3CVE-2021-25760EPSS 0.9%

    In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.

  40. 6.5CVE-2021-25759EPSS 0.7%

    In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.

  41. 6.1CVE-2021-25757EPSS 0.6%

    In JetBrains Hub before 2020.1.12629, an open redirect was possible.

  42. 7.5CVE-2020-11691EPSS 0.9%

    In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.

  43. 5.3CVE-2019-18360EPSS 0.9%

    In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.

  44. 5.3CVE-2019-14955EPSS 0.9%

    In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.

  45. 7.2CVE-2019-12847EPSS 1.1%

    In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contai…