Jetbrains Teamcity
276 CVEs affecting Jetbrains Teamcity. Latest disclosed: 2026-07-27. Critical: 19, High: 41.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63077 | Critical | 9.8 | 2026-07-27 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol |
CVE-2024-27198 | Critical | 9.8 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
CVE-2024-23917 | Critical | 9.8 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2022-25263 | Critical | 9.8 | 2022-02-25 | JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. |
CVE-2022-24340 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. |
CVE-2022-24331 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. |
CVE-2021-43202 | Critical | 9.8 | 2021-11-30 | In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. |
CVE-2021-43200 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. |
CVE-2021-43193 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. |
CVE-2021-37544 | Critical | 9.8 | 2021-08-06 | In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization. |
CVE-2021-31915 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible. |
CVE-2021-31914 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible. |
CVE-2021-31909 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible. |
CVE-2019-18364 | Critical | 9.8 | 2019-10-31 | In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. |
CVE-2019-12157 | Critical | 9.8 | 2019-10-02 | In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. |
CVE-2019-15039 | Critical | 9.8 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1. |
CVE-2026-65907 | Critical | 9.1 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible |
CVE-2023-34218 | Critical | 9.1 | 2023-05-31 | In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible |
CVE-2026-65906 | High | 8.8 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible |