CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product jetbrains:teamcity. Show all products

43 CVEs, showing 1 to 43
CVESeverityTitlePublished
CVE-2023-42793
Known exploited
Critical 9.8In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
Assigned by JetBrains
Sep 19, 2023
CVE-2024-27198
Known exploited
Critical 9.8In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
Assigned by JetBrains
Mar 4, 2024
CVE-2024-27199
Known exploited
High 7.3In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
Assigned by JetBrains
Mar 4, 2024
CVE-2025-67739Low 3.1In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosureDec 11, 2025
CVE-2025-67740Medium 5.3In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadataDec 11, 2025
CVE-2025-67741Medium 5.4In JetBrains TeamCity before 2025.11 stored XSS was possible via session attributeDec 11, 2025
CVE-2025-67742High 7.5In JetBrains TeamCity before 2025.11 path traversal was possible via file uploadDec 11, 2025
CVE-2025-68162Low 2.7In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configurationDec 16, 2025
CVE-2025-68163Medium 4.8In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall pageDec 16, 2025
CVE-2025-68164Low 2.7In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection testDec 16, 2025
CVE-2025-68165Medium 6.1In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setupDec 16, 2025
CVE-2025-68166Medium 6.1In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tabDec 16, 2025
CVE-2025-68267Medium 6.5In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation tokenDec 16, 2025
CVE-2025-68268Medium 6.1In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageDec 16, 2025
CVE-2026-28194Medium 6.1In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flowFeb 25, 2026
CVE-2026-28195Medium 4.3In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurationsFeb 25, 2026
CVE-2026-28196Low 2.3In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on diskFeb 25, 2026
CVE-2026-44413High 7.5In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised accessMay 11, 2026
CVE-2026-49371High 8.2In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleMay 29, 2026
CVE-2026-49372High 7.5In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possibleMay 29, 2026
CVE-2026-49373High 8.8In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settingsMay 29, 2026
CVE-2026-49374High 7.6In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parametersMay 29, 2026
CVE-2026-49375Medium 6.1In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download pageMay 29, 2026
CVE-2026-49376Medium 6.5In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML pluginMay 29, 2026
CVE-2026-49377Medium 4.3In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersMay 29, 2026
CVE-2026-49378Medium 4.3In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletionMay 29, 2026
CVE-2026-49379Medium 6.5In JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesMay 29, 2026
CVE-2026-49380Medium 6.1In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possibleMay 29, 2026
CVE-2026-49381Medium 4.8In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleMay 29, 2026
CVE-2026-59793High 8.8In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integrationJul 10, 2026
CVE-2026-59794Medium 5.4In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported dataJul 10, 2026
CVE-2026-59795Medium 6.1In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possibleJul 10, 2026
CVE-2026-59796High 8.1In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checksJul 10, 2026
CVE-2026-65906Critical 10.0In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possibleJul 23, 2026
CVE-2026-63077
Known exploited
Critical 9.8In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Assigned by JetBrains
Jul 27, 2026
CVE-2026-100253High 8.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100254High 8.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100255High 8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
Assigned by JetBrains
Sep 30, 2026
CVE-2026-106218High 8.8In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
Assigned by JetBrains
Oct 6, 2026
CVE-2026-106219Medium 6.5In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
Assigned by JetBrains
Oct 6, 2026
CVE-2026-111094High 8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
Assigned by JetBrains
Oct 15, 2026
CVE-2026-111095High 8.0In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
Assigned by JetBrains
Oct 15, 2026
CVE-2026-111096Medium 6.7In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
Assigned by JetBrains
Oct 15, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.