CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 06/10/2026 |
| CVE-2026-106218 | CRITICO10.0 | In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible | 06/10/2026 |
| CVE-2026-100255 | CRITICO9.8 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account takeover was possible via password reset | 30/09/2026 |
| CVE-2026-100254 | ALTO8.8 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings | 30/09/2026 |
| CVE-2026-100253 | ALTO8.8 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL | 30/09/2026 |
| CVE-2026-63077KEV | CRITICO9.8 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | 27/07/2026 |
| CVE-2026-65906 | CRITICO10.0 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | 23/07/2026 |
| CVE-2026-59796 | ALTO8.1 | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks | 10/07/2026 |
| CVE-2026-59795 | MEDIO6.1 | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible | 10/07/2026 |
| CVE-2026-59794 | MEDIO5.4 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data | 10/07/2026 |
| CVE-2026-59793 | ALTO8.8 | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration | 10/07/2026 |
| CVE-2026-49381 | MEDIO4.8 | In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible | 29/05/2026 |
| CVE-2026-49380 | MEDIO6.1 | In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible | 29/05/2026 |
| CVE-2026-49379 | MEDIO6.5 | In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names | 29/05/2026 |
| CVE-2026-49378 | MEDIO4.3 | In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion | 29/05/2026 |
| CVE-2026-49377 | MEDIO4.3 | In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters | 29/05/2026 |
| CVE-2026-49376 | MEDIO6.5 | In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin | 29/05/2026 |