HubSpot vulnerabilities
We track 4 vulnerabilities in HubSpot products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest HubSpot vulnerabilities
- 7.4 High severity
HubSpot: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.
- 9.8 Critical severity
jinjava: Improper Neutralization of Special Elements Used in a Template Engine
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instant
- 10.0 Critical severity
jinjava: Improper Neutralization of Special Elements Used in a Template Engine
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attack
- 8.8 High severity
HubSpot – CRM, Email Marketing, Live Chat…: Server-Side Request Forgery
The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks