Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
285 results · page 1 of 6
Oct 15, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possibleCVE-2026-111096 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.7
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possibleCVE-2026-111095 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possibleCVE-2026-111094 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the serverCVE-2026-106219 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possibleCVE-2026-106218 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password resetCVE-2026-100255 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connCVE-2026-100254 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSLCVE-2026-100253 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026JetBrains TeamCity Deserialization of Untrusted Data VulnerabilityCVE-2026-63077 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
- Product
- TeamCity
- On CISA’s list since
- Aug 5, 2026 (federal fix deadline Aug 8, 2026)
- What to do
- Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogjetbrains.comcisa.gov
Jul 23, 2026In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possibleCVE-2026-65907 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.1
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possibleCVE-2026-65906 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checksCVE-2026-59796 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possibleCVE-2026-59795 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported dataCVE-2026-59794 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.3
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integrationCVE-2026-59793 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleCVE-2026-49381 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.4
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possibleCVE-2026-49380 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesCVE-2026-49379 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletionCVE-2026-49378 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersCVE-2026-49377 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML pluginCVE-2026-49376 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download pageCVE-2026-49375 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parametersCVE-2026-49374 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.6
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settingsCVE-2026-49373 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possibleCVE-2026-49372 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleCVE-2026-49371 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised accessCVE-2026-44413 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.2
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on diskCVE-2026-28196 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.3
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurationsCVE-2026-28195 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flowCVE-2026-28194 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageCVE-2025-68268 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation tokenCVE-2025-68267 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tabCVE-2025-68166 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setupCVE-2025-68165 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection testCVE-2025-68164 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall pageCVE-2025-68163 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configurationCVE-2025-68162 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In JetBrains TeamCity before 2025.11 path traversal was possible via file uploadCVE-2025-67742 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.8
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In JetBrains TeamCity before 2025.11 stored XSS was possible via session attributeCVE-2025-67741 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadataCVE-2025-67740 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosureCVE-2025-67739 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on WindowsCVE-2025-59457 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive uploadCVE-2025-59456 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionCVE-2025-59455 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.2
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script filesCVE-2025-57734 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email contentCVE-2025-57733 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownershipCVE-2025-57732 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" commandCVE-2025-54538 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshotsCVE-2025-54537 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpointCVE-2025-54536 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.