Skip to content

Exploited: 178

LatestCVE-2026-107622 — BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

8.1

CVE-2026-123295Fix available

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

JetBrains Hub2026-11-06 10:27 UTC1 min readRead in

Summary

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

Remediation

Inventory every JetBrains Hub deployment, including staging.
Upgrade JetBrains Hub to 2026.2.52519.
Confirm the running version after the upgrade.

References

Referencehttps://www.jetbrains.com/privacy-security/issues-fixed/

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected versions

Version	Fixed in
0 – <2026.2.52519	2026.2.52519

Weakness

CWE-863

Timeline

2026-11-06Publicly disclosed

Sources

CVE · NVD