CVE Tools
Track your stack

Teamcity

284 CVEs tracked. 4 of them are in CISA KEV.

This hub aggregates every CVE we track for Teamcity, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Teamcity CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Teamcity CVEs per month
MonthCVEs
2024-110
2024-129
2025-013
2025-022
2025-033
2025-043
2025-054
2025-065
2025-0711
2025-083
2025-093
2025-100
2025-110
2025-1211
2026-010
2026-023
2026-030
2026-040
2026-0512
2026-060
2026-077
2026-080
2026-093
2026-105

Severity

How the 284 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical197%
  • High4717%
  • Medium18866%
  • Low3011%

Latest CVEs

The 15 most recently published vulnerabilities affecting Teamcity.

  1. CVE-2026-111095In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible8.0
  2. CVE-2026-111096In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible6.7
  3. CVE-2026-111094In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible8.1
  4. CVE-2026-106219In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server6.5
  5. CVE-2026-106218In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible8.8
  6. CVE-2026-100255In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset8.1
  7. CVE-2026-100254In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings8.8
  8. CVE-2026-100253In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL8.8
  9. CVE-2026-63077In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol9.8
  10. CVE-2026-65907In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible9.1
  11. CVE-2026-65906In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible8.8
  12. CVE-2026-59796In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks8.1
  13. CVE-2026-59795In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible8.1
  14. CVE-2026-59794In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data7.3
  15. CVE-2026-59793In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration8.8

Product grouping is registry-driven, with AI assist and human review. How it works