critical · CVSS v3 9.6

CVE-2026-123294

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during t…

Description

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.6
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-119516

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.

View analysis

critical

CVE-2026-120844

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

View analysis

critical

CVE-2026-88799

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.

View analysis

critical

CVE-2026-88800

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

View analysis