CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 高危8.2 |
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible |
| 29/05/2026 |
| CVE-2026-44413 | 高危7.5 | In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access | 11/05/2026 |
| CVE-2026-28196 | 低危2.3 | In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk | 25/02/2026 |
| CVE-2026-28195 | 中危4.3 | In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations | 25/02/2026 |
| CVE-2026-28194 | 中危6.1 | In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow | 25/02/2026 |
| CVE-2025-68268 | 中危6.1 | In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page | 16/12/2025 |
| CVE-2025-68267 | 中危6.5 | In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token | 16/12/2025 |
| CVE-2025-68166 | 中危6.1 | In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab | 16/12/2025 |
| CVE-2025-68165 | 中危6.1 | In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup | 16/12/2025 |
| CVE-2025-68164 | 低危2.7 | In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test | 16/12/2025 |
| CVE-2025-68163 | 中危4.8 | In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page | 16/12/2025 |
| CVE-2025-68162 | 低危2.7 | In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration | 16/12/2025 |
| CVE-2025-67742 | 高危7.5 | In JetBrains TeamCity before 2025.11 path traversal was possible via file upload | 11/12/2025 |
| CVE-2025-67741 | 中危5.4 | In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute | 11/12/2025 |
| CVE-2025-67740 | 中危5.3 | In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata | 11/12/2025 |
| CVE-2025-67739 | 低危3.1 | In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure | 11/12/2025 |