cve.bz

jetbrains hub vulnerabilities in 2026, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 2.7CVE-2026-123300EPSS 0.3%

    In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

  2. 3.1CVE-2026-123299EPSS 0.2%

    In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

  3. 5.0CVE-2026-123298EPSS 0.6%

    In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

  4. 6.8CVE-2026-123297EPSS 0.3%

    In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

  5. 7.5CVE-2026-123296EPSS 0.3%

    In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

  6. 8.1CVE-2026-123295EPSS 0.4%

    In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

  7. 9.6CVE-2026-123294EPSS 0.4%

    In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

  8. 6.5CVE-2026-100266EPSS 0.2%

    In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

  9. 9.8CVE-2026-86480EPSS 0.6%

    In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

  10. 8.8CVE-2026-56142EPSS 0.6%

    In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

  11. 9.8CVE-2026-56141EPSS 0.5%

    In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

  12. 9.8CVE-2026-50242EPSS 0.6%

    In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

  13. 6.8CVE-2026-32229EPSS 0.2%

    In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

  14. 9.8CVE-2026-25848EPSS 0.5%

    In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible