Skip to content

Exploited: 178

LatestCVE-2026-107622 — BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

7.5

CVE-2026-123296Fix available

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

JetBrains Hub2026-11-06 10:27 UTC1 min readRead in

Summary

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

Remediation

Inventory every JetBrains Hub deployment, including staging.
Upgrade JetBrains Hub to 2026.2.52519.
Confirm the running version after the upgrade.

References

Referencehttps://www.jetbrains.com/privacy-security/issues-fixed/

CVSS vector

Attack vector: Network
Complexity: High
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
0 – <2026.2.52519	2026.2.52519

Weakness

CWE-863

Timeline

2026-11-06Publicly disclosed

Sources

CVE · NVD