CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,238 CVEs published, 240 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,238
Show in the list
Critical, last 7 days
240
Show in the list
Healthcare-tagged, last 7 days
6
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product jetbrains:teamcity. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

44 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-111096Medium 6.7In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
Assigned by JetBrains
Oct 15, 2026
CVE-2026-111095High 8.0In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
Assigned by JetBrains
Oct 15, 2026
CVE-2026-111094High 8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
Assigned by JetBrains
Oct 15, 2026
CVE-2026-106219Medium 6.5In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
Assigned by JetBrains
Oct 6, 2026
CVE-2026-106218High 8.8In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
Assigned by JetBrains
Oct 6, 2026
CVE-2026-100255High 8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100254High 8.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
Assigned by JetBrains
Sep 30, 2026
CVE-2026-100253High 8.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
Assigned by JetBrains
Sep 30, 2026
CVE-2026-63077
Known exploited
Critical 9.8In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Assigned by JetBrains
Jul 27, 2026
CVE-2026-65907Critical 9.1In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
Assigned by JetBrains
Jul 23, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .