CVE Tools
Track your stack

Hub

135 CVEs tracked. None of them is in CISA KEV.

This Hub aggregates every CVE we track for Hub, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Hub CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Hub CVEs per month
MonthCVEs
2024-120
2025-011
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-113
2025-120
2026-012
2026-021
2026-031
2026-040
2026-050
2026-063
2026-071
2026-081
2026-092
2026-100
2026-117

Severity

How the 135 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical9167%
  • High1410%
  • Medium2116%
  • Low97%

Latest CVEs

The 15 most recently published vulnerabilities affecting Hub.

  1. CVE-2026-123300In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings2.7
  2. CVE-2026-123299In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible3.1
  3. CVE-2026-123297In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow6.8
  4. CVE-2026-123298In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible5.0
  5. CVE-2026-123295In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint8.1
  6. CVE-2026-123296In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible7.5
  7. CVE-2026-123294In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow9.6
  8. CVE-2026-100266In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address7.7
  9. CVE-2026-86480In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges9.8
  10. CVE-2026-73561Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion7.5
  11. CVE-2026-47690MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow7.5
  12. CVE-2026-50242In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was...10.0
  13. CVE-2026-56141In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible9.8
  14. CVE-2026-56142In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible9.9
  15. CVE-2026-32229In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled6.8

Product grouping is registry-driven, with AI assist and human review. How it works