3.4
CVSS
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
Severity: LOW
📦
teamcity
Vendor: jetbrains
Actively Exploited
3
CISA KEV List
PoC / Exploits
6
Code Available
Total RCEs
15
Remote Access
Total CVEs
327
Total Indexed
Avg. EPSS
4.02%
Exploit Prob.
Security Vulnerability Index
Page 1 / 33
3.1
CVSS
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
Severity: LOW
6.5
CVSS
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
Severity: MEDIUM
4.3
CVSS
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
Severity: MEDIUM
4.3
CVSS
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
Severity: MEDIUM
6.5
CVSS
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
Severity: MEDIUM
6.1
CVSS
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
Severity: MEDIUM
7.6
CVSS
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
Severity: HIGH
7.1
CVSS
CVE-2026-49373
RCE
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
Severity: HIGH
7.5
CVSS
In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
Severity: HIGH