Hub at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 7 | 1 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 2 | 1 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 3 | 3 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 1 | 0 |
| Feb 2026 | 1 | 1 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 1 | 0 |
| Dec 2024 | 0 | 0 |
25 results · Feed
-
Low 3.1
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
-
Low 2.7
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module gr…
-
Medium 6.8
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
-
Medium 5.0
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
-
High 8.1
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoi…
-
High 7.5
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
-
Critical 9.6
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during …
-
High 7.7
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from th…
-
Critical 9.8
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser pr…
-
Critical 10.0
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authent…
-
Critical 9.8
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account…
-
Critical 9.6
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privile…
-
Medium 6.8
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
-
Critical 9.1
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
-
Medium 5.3
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
-
Low 2.7
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
-
Low 2.7
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
-
Medium 6.7
In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
-
Medium 4.3
In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorize…
-
Low 3.5
In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible
-
Medium 4.1
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
-
Medium 4.6CVE-2022-48429 Public exploit
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
-
Low 3.5
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
-
Low 3.5
In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services
-
Medium 6.1
In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.