Jetbrains Teamcity vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jetbrains Teamcity: 44 record(s), with affected versions and fixes.cpe:2.3:a:jetbrains:teamcity
CVE-2026-111096
Medium · 6.7
CWE-79 Oct 15, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible
CVE-2026-111095
High · 8.0
CWE-79 Oct 15, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possible
CVE-2026-111094
High · 8.1
CWE-502 Oct 15, 2026
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist...
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVE-2026-106219
High · 7.5
CWE-73 Oct 6, 2026
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed…
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
CVE-2026-106218
Critical · 10.0
CWE-184 Oct 6, 2026
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE…
In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
CVE-2026-100255
Critical · 9.8
CWE-1289 Sep 30, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover…
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account takeover was possible via password reset
CVE-2026-100254
High · 8.8
CWE-78 Sep 30, 2026
OS Command Injection in Jetbrains Teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
CVE-2026-100253
High · 8.8
CWE-184 Sep 30, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code…
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
CVE-2026-63077
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-502 Jul 27, 2026
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-65907
Critical · 9.1
CWE-94 Jul 23, 2026
Code Injection in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
CVE-2026-65906
Critical · 10.0
CWE-94 Jul 23, 2026
Code Injection in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVE-2026-59796
High · 8.1
CWE-862 Jul 10, 2026
Missing Authorization in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
CVE-2026-59795
Medium · 6.1
CWE-79 Jul 10, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
CVE-2026-59794
Medium · 5.4
CWE-79 Jul 10, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
CVE-2026-59793
High · 8.8
CWE-73 Jul 10, 2026
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the…
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
CVE-2026-49381
Medium · 4.8
CWE-79 May 29, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
CVE-2026-49380
Medium · 6.1
CWE-601 May 29, 2026
Open Redirect in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
CVE-2026-49379
Medium · 6.5
CWE-522 May 29, 2026
Insufficiently Protected Credentials in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
CVE-2026-49378
Medium · 4.3
CWE-862 May 29, 2026
Missing Authorization in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
CVE-2026-49377
Medium · 4.3
CWE-526 May 29, 2026
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent…
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
CVE-2026-49376
Medium · 6.5
CWE-863 May 29, 2026
Incorrect Authorization in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
CVE-2026-49375
Medium · 6.1
CWE-79 May 29, 2026
Cross-site Scripting (XSS) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page
CVE-2026-49374
High · 7.6
CWE-862 May 29, 2026
Missing Authorization in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
CVE-2026-49373
High · 8.8
CWE-88 May 29, 2026
Argument Injection in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
CVE-2026-49372
High · 7.5
CWE-918 May 29, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Teamcity
In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible