Skip to contentJetbrains Teamcity vulnerabilities
- jetbrains teamcityIn JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log...CVE-2026-1110966.7 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project...CVE-2026-1110958.0 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist...CVE-2026-1110948.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading...CVE-2026-1062196.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the...CVE-2026-1062188.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account takeover was...CVE-2026-1002558.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute...CVE-2026-1002548.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code...CVE-2026-1002538.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was...CVE-2026-63077In KEVPublic exploitEPSS 94.9%9.8 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possibleCVE-2026-659079.1 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was...CVE-2026-659068.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper...CVE-2026-597968.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possibleCVE-2026-59795Public exploit8.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent...CVE-2026-597947.3 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS...CVE-2026-597938.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleCVE-2026-493813.4 Low
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possibleCVE-2026-493803.1 Low
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesCVE-2026-493796.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletionCVE-2026-493784.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersCVE-2026-493774.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 insufficient username validation in the SAML pluginCVE-2026-493766.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository...CVE-2026-493756.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration...CVE-2026-493747.6 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection...CVE-2026-49373EPSS 32.7%7.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possibleCVE-2026-493727.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleCVE-2026-493717.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to...CVE-2026-444138.2 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on...CVE-2026-281962.3 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add...CVE-2026-281954.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flowCVE-2026-281944.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageCVE-2025-682685.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub...CVE-2025-682676.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tabCVE-2025-681665.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setupCVE-2025-681655.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection testCVE-2025-681642.7 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall pageCVE-2025-681633.5 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project...CVE-2025-681622.7 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 path traversal was possible via file uploadCVE-2025-677423.8 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 stored XSS was possible via session attributeCVE-2025-677414.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's...CVE-2025-677402.7 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local...CVE-2025-677393.1 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on...CVE-2025-594577.7 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive uploadCVE-2025-59456EPSS 15.5%5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionCVE-2025-594554.2 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script filesCVE-2025-577344.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email...CVE-2025-577335.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect...CVE-2025-577327.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg...CVE-2025-545385.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshotsCVE-2025-545375.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpointCVE-2025-545365.4 Medium
- Show olderLoading…