Jetbrains Teamcity vulnerabilities
284 vulnerabilities
Known vulnerabilities in Jetbrains Teamcity, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-111096jetbrainsteamcity
EPSS score0.18%
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possibleCVE-2026-111095jetbrainsteamcityEPSS score0.17%
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possibleCVE-2026-111094jetbrainsteamcityEPSS score0.38%
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possibleCVE-2021-26309jetbrainsteamcityEPSS score0.24%
Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.CVE-2021-26310jetbrainsteamcityEPSS score1.56%
In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.CVE-2021-31906jetbrainsteamcityEPSS score0.58%
In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.CVE-2021-31913jetbrainsteamcityEPSS score0.71%
In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.CVE-2021-31910jetbrainsteamcityEPSS score1.36%
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.CVE-2021-31908jetbrainsteamcityEPSS score0.47%
In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.CVE-2021-31912jetbrainsteamcityEPSS score1.24%
In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.CVE-2021-31914jetbrainsteamcityEPSS score2.27%
In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.CVE-2021-31904jetbrainsteamcityEPSS score0.75%
In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.CVE-2021-31907jetbrainsteamcityEPSS score0.89%
In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.CVE-2021-31915jetbrainsteamcityEPSS score3.21%
In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.CVE-2021-31911jetbrainsteamcityEPSS score0.75%
In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.CVE-2021-31909jetbrainsteamcityEPSS score3.23%
In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.CVE-2021-25774jetbrainsteamcityEPSS score0.66%
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.CVE-2021-25777jetbrainsteamcityEPSS score0.73%
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.CVE-2021-25776jetbrainsteamcityEPSS score1.08%
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.CVE-2021-25775jetbrainsteamcityEPSS score0.63%
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.