| CVE-2026-111096 | MEDIO5.4 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible | 15/10/2026 |
| CVE-2026-111095 | MEDIO5.4 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possible | 15/10/2026 |
| CVE-2026-111094 | CRÍTICO9.8 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible | 15/10/2026 |
| CVE-2026-106219 | ALTO7.5 | In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server | 06/10/2026 |
| CVE-2026-106218 | CRÍTICO10.0 | In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible | 06/10/2026 |
| CVE-2026-100255 | CRÍTICO9.8 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account takeover was possible via password reset | 30/09/2026 |
| CVE-2026-100254 | ALTO8.8 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings | 30/09/2026 |
| CVE-2026-100253 | ALTO8.8 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL | 30/09/2026 |
| CVE-2026-63077KEV | CRÍTICO9.8 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | 27/07/2026 |
| CVE-2026-65906 | CRÍTICO10.0 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | 23/07/2026 |
| CVE-2026-59796 | ALTO8.1 | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks | 10/07/2026 |
| CVE-2026-59795 | MEDIO6.1 | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible | 10/07/2026 |
| CVE-2026-59794 | MEDIO5.4 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data | 10/07/2026 |
| CVE-2026-59793 | ALTO8.8 | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration | 10/07/2026 |
| CVE-2026-49381 | MEDIO4.8 | In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible | 29/05/2026 |
| CVE-2026-49380 | MEDIO6.1 | In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible | 29/05/2026 |
| CVE-2026-49379 | MEDIO6.5 | In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names | 29/05/2026 |
| CVE-2026-49378 | MEDIO4.3 | In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion | 29/05/2026 |
| CVE-2026-49377 | MEDIO4.3 | In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters | 29/05/2026 |
| CVE-2026-49376 | MEDIO6.5 | In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin | 29/05/2026 |