| CVE-2026-100266 | TRUNG BÌNH6.5 | In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address | 30/09/2026 |
| CVE-2026-56142 | CAO8.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 privilege escalation by attaching authentication details to accounts was possible | 19/06/2026 |
| CVE-2026-56141 | NGHIÊM TRỌNG9.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 account takeover via predictable restore codes was possible | 19/06/2026 |
| CVE-2026-50242 | NGHIÊM TRỌNG9.8 | In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | 19/06/2026 |
| CVE-2026-32229 | TRUNG BÌNH6.8 | In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled | 11/03/2026 |
| CVE-2026-25848 | NGHIÊM TRỌNG9.8 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible | 09/02/2026 |
| CVE-2025-64683 | CAO7.5 | In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API | 10/11/2025 |
| CVE-2025-64682 | THẤP3.7 | In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit | 10/11/2025 |
| CVE-2025-64681 | THẤP3.7 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations | 10/11/2025 |
| CVE-2025-24456 | CAO8.8 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping | 21/01/2025 |
| CVE-2024-50573 | TRUNG BÌNH5.4 | In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services | 28/10/2024 |
| CVE-2024-38507 | TRUNG BÌNH5.4 | In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible | 18/06/2024 |
| CVE-2022-48477 | NGHIÊM TRỌNG9.8 | In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
| 24/04/2023 |
| CVE-2022-48429 | TRUNG BÌNH5.4 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
| 27/03/2023 |
| CVE-2022-45471 | CAO7.5 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address | 18/11/2022 |
| CVE-2022-34894 | TRUNG BÌNH5.3 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services | 01/07/2022 |
| CVE-2022-29811 | TRUNG BÌNH4.8 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. | 28/04/2022 |
| CVE-2022-25262 | NGHIÊM TRỌNG9.8 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. | 25/02/2022 |
| CVE-2022-25260 | NGHIÊM TRỌNG9.1 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). | 25/02/2022 |
| CVE-2022-25259 | TRUNG BÌNH6.1 | JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. | 25/02/2022 |