CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names |
| 29/05/2026 |
| CVE-2026-49378 | MITTEL4.3 | In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion | 29/05/2026 |
| CVE-2026-49377 | MITTEL4.3 | In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters | 29/05/2026 |
| CVE-2026-49376 | MITTEL6.5 | In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin | 29/05/2026 |
| CVE-2026-49375 | MITTEL6.1 | In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page | 29/05/2026 |
| CVE-2026-49374 | HOCH7.6 | In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters | 29/05/2026 |
| CVE-2026-49373 | HOCH8.8 | In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings | 29/05/2026 |
| CVE-2026-49372 | HOCH7.5 | In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible | 29/05/2026 |
| CVE-2026-49371 | HOCH8.2 | In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible | 29/05/2026 |
| CVE-2026-49370 | HOCH7.5 | In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests | 29/05/2026 |
| CVE-2026-49369 | MITTEL4.3 | In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages | 29/05/2026 |
| CVE-2026-49368 | MITTEL5.4 | In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible | 29/05/2026 |
| CVE-2026-49367 | HOCH8.8 | In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account | 29/05/2026 |
| CVE-2026-49366 | HOCH7.8 | In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion | 29/05/2026 |
| CVE-2026-44413 | HOCH7.5 | In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access | 11/05/2026 |
| CVE-2026-41882 | HOCH7.5 | In JetBrains IntelliJ IDEA before 2024.3.7.1,
2025.1.7.1,
2025.2.6.2,
2025.3.4.1,
2026.1.1 reading arbitrary local files was possible via built-in web server | 30/04/2026 |