Login Request a demo
HU
Product
Hub
by JetBrains · last CVE Sep 30, 2026
38
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities38In the news0Timeline
Severity mix
Critical 9High 10Medium 17Low 2
Severity
All severities38Critical9High10Medium17Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Hub to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-86480
9.8
1%
Sep 7
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
Affected: before 2026.2.52442
CVE-2026-50242
9.8
1%
Jun 19
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to…
Affected: before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
CVE-2026-56141
9.8
1%
Jun 19
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible
Affected: before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
CVE-2026-25848
9.8
0%
Feb 9
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
Affected: before 2025.3.119807
CVE-2022-48477
9.8
0%
Apr 24
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
Affected: before 2023.1.15725
CVE-2022-25262
9.8
1%
Feb 25
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible
Affected: before 2022.1.14434
CVE-2021-43183
9.8
1%
Nov 9
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed
Affected: before 2021.1.13690
CVE-2021-36209
9.8
1%
Aug 6
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset
Affected: before 2021.1.13389
CVE-2022-25260
9.1
2%
Feb 25
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF)
Affected: before 2021.1.14276
Showing 9