JetBrains TeamCity

• CVE-2026-63077 Critical 9.8 Exploited In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol 94.9%
• CVE-2024-27199 High 7.3 Exploited In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible 100.0%
• CVE-2024-27198 Critical 9.8 Exploited In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible 99.9%
• CVE-2023-42793 Critical 9.8 Exploited In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible 100.0%
• CVE-2026-111096 Medium 6.7 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible 0.2%
• CVE-2026-111095 High 8.0 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible 0.2%
• CVE-2026-111094 High 8.1 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible 0.4%
• CVE-2026-106219 Medium 6.5 In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server 0.7%
• CVE-2026-106218 High 8.8 In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible 0.3%
• CVE-2026-100255 High 8.1 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset 0.4%
• CVE-2026-100254 High 8.8 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings 0.5%
• CVE-2026-100253 High 8.8 In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL 0.4%
• CVE-2026-65907 Critical 9.1 In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible 0.7%
• CVE-2026-65906 High 8.8 In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible 0.7%
• CVE-2026-59796 High 8.1 In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks 0.4%
• CVE-2026-59795 High 8.1 In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible 0.3%
• CVE-2026-59794 High 7.3 In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data 0.3%
• CVE-2026-59793 High 8.8 In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration 0.5%
• CVE-2026-49381 Low 3.4 In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible 0.2%
• CVE-2026-49380 Low 3.1 In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible 0.2%
• CVE-2026-49379 Medium 6.5 In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names 0.3%
• CVE-2026-49378 Medium 4.3 In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion 0.2%
• CVE-2026-49377 Medium 4.3 In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters 0.7%
• CVE-2026-49376 Medium 6.5 In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin 0.2%
• CVE-2026-49375 Medium 6.1 In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page 0.2%
• CVE-2026-49374 High 7.6 In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters 0.2%
• CVE-2026-49373 High 7.1 In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings 24.9%
• CVE-2026-49372 High 7.5 In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible 0.3%
• CVE-2026-49371 High 7.1 In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible 0.3%
• CVE-2026-44413 High 8.2 In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access 0.3%
• CVE-2026-28196 Low 2.3 In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk 0.1%
• CVE-2026-28195 Medium 4.3 In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations 0.2%
• CVE-2026-28194 Medium 4.3 In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow 0.2%
• CVE-2025-68268 Medium 5.4 In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page 0.2%
• CVE-2025-68267 Medium 6.5 In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token 0.2%
• CVE-2025-68166 Medium 5.4 In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab 0.2%
• CVE-2025-68165 Medium 5.4 In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup 4.2%
• CVE-2025-68164 Low 2.7 In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test 0.2%
• CVE-2025-68163 Low 3.5 In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page 0.2%
• CVE-2025-68162 Low 2.7 In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration 0.2%
• CVE-2025-67742 Low 3.8 In JetBrains TeamCity before 2025.11 path traversal was possible via file upload 0.8%
• CVE-2025-67741 Medium 4.8 In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute 0.5%
• CVE-2025-67740 Low 2.7 In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata 0.2%
• CVE-2025-67739 Low 3.1 In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure 0.2%
• CVE-2025-59457 High 7.7 In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows 0.8%
• CVE-2025-59456 Medium 5.5 In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload 15.5%
• CVE-2025-59455 Medium 4.2 In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition 0.4%
• CVE-2025-57734 Medium 4.3 In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files 0.8%
• CVE-2025-57733 Medium 5.5 In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content 0.3%
• CVE-2025-57732 High 7.5 In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership 0.1%