Hub
127 CVEs tracked. None of them is in CISA KEV.
This Hub aggregates every CVE we track for Hub, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Hub CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 3 |
| 2025-12 | 0 |
| 2026-01 | 2 |
| 2026-02 | 1 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 3 |
| 2026-07 | 1 |
| 2026-08 | 1 |
| 2026-09 | 1 |
Severity
How the 127 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical90
- High11
- Medium19
- Low7
Latest CVEs
The 15 most recently published vulnerabilities affecting Hub.
- CVE-2026-86480In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges9.8
- CVE-2026-73561Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion7.5
- CVE-2026-47690MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow7.5
- CVE-2026-50242In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was...10.0
- CVE-2026-56141In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible9.8
- CVE-2026-56142In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible9.9
- CVE-2026-32229In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled6.8
- CVE-2026-25848In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible9.1
- CVE-2025-65784Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' information via a crafted API request.6.5
- CVE-2025-65783An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code via uploading a crafted P...9.8
- CVE-2025-64683In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API5.3
- CVE-2025-64682In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit2.7
- CVE-2025-64681In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations2.7
- CVE-2025-24456In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping6.7
- CVE-2024-50573In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services4.3
Product grouping is registry-driven, with AI assist and human review. How it works