JetBrains Hub vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20232
3. 20242
4. 20254
5. 20267

Newest CVEs

• CVE-2026-100266

  In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

  JetBrains · Hub

  High7.7
• CVE-2026-86480

  In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

  JetBrains · Hub

  Critical9.8
• CVE-2026-50242

  In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database…

  JetBrains · Hub

  Critical10.0
• CVE-2026-56142

  In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching…

  JetBrains · Hub

  Critical9.6
• CVE-2026-56141

  In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes…

  JetBrains · Hub

  Critical9.8
• CVE-2026-32229

  In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

  JetBrains · Hub

  Medium6.8
• CVE-2026-25848

  In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

  JetBrains · Hub

  Critical9.1
• CVE-2025-64683

  In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

  JetBrains · Hub

  Medium5.3
• CVE-2025-64682

  In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

  JetBrains · Hub

  Low2.7
• CVE-2025-64681

  In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations

  JetBrains · Hub

  Low2.7