Hub

CVE-2026-86480 Sep 07, 16:26 CRITICAL PATCH Act Now

Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

CVE-2026-73561 Aug 13, 17:24 npm HIGH POC PATCH GHSA This Week

Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server CPU and memory by opening WebSocket connections and ignoring all server RPC messages. Each connection triggers a 10ms setInterval polling loop and a heap entry in the RPC request queue; because the socket close handler never cancels these allocations, they accumulate without bound until the process becomes unresponsive. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v0.2.16.

CVE-2026-47690 Jul 21, 20:46 HIGH POC PATCH This Week

Privileged GITHUB_TOKEN exfiltration in the meltano/hub repository allows any unauthenticated attacker who can open a pull request to inject shell commands into the test_dispatcher.yml GitHub Actions workflow and steal a repository-write token. Because the workflow uses the pull_request_target trigger, it executes untrusted PR-controlled data (changed filenames) in the trusted base-repository context with access to secrets. Publicly available exploit code exists (a dedicated PoC repo), though this is not listed in CISA KEV.

CVE-2026-50242 Jun 19, 11:49 CRITICAL PATCH Act Now

Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other JetBrains tools) lets an actor obtain administrative access by going through direct database access, per JetBrains' own advisory. Classified under CWE-306 (Missing Authentication for a Critical Function) and vendor-scored CVSS 9.8, it affects all builds before the fixed 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 releases. There is no public exploit identified at time of analysis and the EPSS probability is low (0.44%, 35th percentile), but full administrative compromise is the stated technical impact.

CVE-2026-56142 Jun 19, 11:49 HIGH PATCH This Week

Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429) allows an authenticated attacker to attach additional authentication details to existing accounts, enabling unauthorized access and elevation of privileges. The flaw, self-reported by JetBrains and patched, carries a CVSS 8.8 with high impact to confidentiality, integrity, and availability; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.41%).

CVE-2026-56141 Jun 19, 11:49 CRITICAL PATCH Act Now

Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429. Remote unauthenticated attackers can guess or predict the restore codes used for account recovery, enabling them to seize control of arbitrary user accounts. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects the high impact of full account compromise across an identity management platform.

CVE-2026-25848 Feb 09, 11:16 CRITICAL Act Now

JetBrains Hub before 2025.3.119807 has an authentication bypass allowing administrative actions without proper credentials.

CVE-2026-100266 Sep 30, 15:17 MEDIUM PATCH This Month

Authenticated users of JetBrains Hub can send arbitrary emails from the server's trusted address due to a missing authorization check in versions before 2026.2.52366. The flaw requires a valid low-privilege Hub account (PR:L) and network reachability to the instance, but no user interaction; it allows spoofing outbound email, which can damage trust in the organization's sender identity. No public exploit has been identified at time of analysis, and the vendor has released a patch.

CVE-2026-32229 Mar 11, 15:16 MEDIUM This Month

JetBrains Hub versions prior to 2026.1 contain an authentication bypass vulnerability where attackers with valid credentials can gain unauthorized access to accounts through sign-in mismatches when SSO is disabled and two-factor authentication is not configured. An authenticated attacker can exploit this to achieve both confidentiality and integrity violations. No patch is currently available for this vulnerability.

CVE-2025-65784 Jan 13, 17:15 MEDIUM POC This Month

Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' information via a crafted API request. [CVSS 6.5 MEDIUM]

CVE-2025-65783 Jan 13, 16:15 CRITICAL Act Now

Hub v2.0 property management system allows unauthenticated arbitrary file upload via /utils/uploadFile. Malicious PDF files can be uploaded and may achieve code execution.

CVE-2025-64683 Nov 10, 14:15 MEDIUM This Month

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-64682 Nov 10, 14:15 LOW Monitor

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-64681 Nov 10, 14:15 LOW Monitor

In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-24456 Jan 21, 18:15 MEDIUM This Month

In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2024-50573 Oct 28, 13:15 MEDIUM This Month

In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-38507 Jun 18, 11:15 MEDIUM This Month

In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-45823 Oct 19, 21:15 Go HIGH PATCH This Week

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-45822 Oct 19, 21:15 Go MEDIUM PATCH This Month

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-45821 Oct 19, 21:15 Go MEDIUM PATCH This Month

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-45471 Nov 18, 15:15 HIGH This Week

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-34894 Jul 01, 10:15 MEDIUM This Month

In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-29811 Apr 28, 10:15 MEDIUM This Month

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-25262 Feb 25, 20:15 CRITICAL Act Now

In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-25260 Feb 25, 20:15 CRITICAL Act Now

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-25259 Feb 25, 20:15 MEDIUM This Month

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-24328 Feb 25, 15:15 MEDIUM This Month

In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-24327 Feb 25, 15:15 HIGH This Week

In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-43182 Nov 09, 16:15 HIGH This Week

In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-43181 Nov 09, 16:15 MEDIUM This Month

In JetBrains Hub before 2021.1.13690, stored XSS is possible. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-43180 Nov 09, 16:15 HIGH This Week

In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-43183 Nov 09, 15:15 CRITICAL Act Now

In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-37541 Aug 06, 14:15 MEDIUM This Month

In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-37540 Aug 06, 14:15 MEDIUM This Month

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-36209 Aug 06, 14:15 CRITICAL Act Now

In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-31901 May 11, 12:15 HIGH This Week

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-25760 Feb 03, 16:15 MEDIUM This Month

In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-25759 Feb 03, 16:15 MEDIUM This Month

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-25757 Feb 03, 16:15 MEDIUM This Month

In JetBrains Hub before 2020.1.12629, an open redirect was possible. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-11691 Apr 22, 14:15 HIGH This Week

In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-18360 Oct 31, 15:15 MEDIUM This Month

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-14955 Oct 01, 16:15 MEDIUM This Month

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-12847 Jul 03, 19:15 HIGH This Week

In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2014-0177 May 27, 14:55 LIB LOW POC PATCH Monitor

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file. Rated low severity (CVSS 3.6), this vulnerability is low attack complexity. Public exploit code available.