Jetbrains Hub vulnerabilities, page 2
38 vulnerabilities
Known vulnerabilities in Jetbrains Hub, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-25259jetbrainshub
EPSS score0.57%
JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.CVE-2022-29811jetbrainshubEPSS score0.48%
In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.CVE-2022-24328jetbrainshubEPSS score0.82%
In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.CVE-2022-24327jetbrainshubEPSS score0.91%
In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.CVE-2022-45471jetbrainshubEPSS score0.55%
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email addressCVE-2022-34894jetbrainshubEPSS score0.59%
In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted servicesCVE-2024-38507jetbrainshubEPSS score0.24%
In JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleCVE-2024-50573jetbrainshubEPSS score0.22%
In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized servicesCVE-2019-14955jetbrainshubEPSS score0.92%
In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.CVE-2019-18360jetbrainshubEPSS score0.86%
In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.CVE-2019-12847jetbrainshubEPSS score1.11%
In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period.CVE-2026-86480jetbrainshubEPSS score0.50%
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privilegesCVE-2026-25848jetbrainshubEPSS score0.65%
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possibleCVE-2026-56141jetbrainshubEPSS score0.52%
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 account takeover via predictable restore codes was possibleCVE-2026-56142jetbrainshubEPSS score0.62%
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 privilege escalation by attaching authentication details to accounts was possibleCVE-2026-100266jetbrainshubEPSS score0.23%
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted addressCVE-2026-32229jetbrainshubEPSS score0.29%
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabledCVE-2026-50242jetbrainshubEPSS score0.61%
In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible