Known vulnerabilities in TeamCity

Software: TeamCity
Software CPE: cpe:2.3:a:jetbrains_s.r.o.:teamcity:*:*:*:*:*:*:*:*
Total vulnerabilities: 123
Public exploits: 4
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting TeamCity TeamCity is affected by 123 known vulnerabilities: 2 critical, 8 high, 39 medium, 74 low Critical High Medium Low

Vulnerabilities (123)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU153918 - External Control of File Name or Path
CVE-2026-106219
CWE-73 Medium
No
No
2026.2.1 07.10.2026 SB20261007233
#VU153917 - Incomplete List of Disallowed Inputs
CVE-2026-106218
CWE-184 Low
No
No
2025.11.7, 2026.1.3 07.10.2026 SB20260731170
#VU153135 - Incomplete List of Disallowed Inputs
CVE-2026-100253
CWE-184 Medium
No
No
2025.11.8, 2026.1.4, 2026.2 02.10.2026 SB2026100226
#VU153134 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-100254
CWE-78 Medium
No
No
2025.11.8, 2026.1.4, 2026.2 02.10.2026 SB2026100226
#VU153133 - Improper Validation of Unsafe Equivalence in Input
CVE-2026-100255
CWE-1289 High
No
No
2025.11.8, 2026.1.4, 2026.2 02.10.2026 SB2026100226
#VU143914 - Permissive List of Allowed Inputs
CVE-2025-59457
CWE-183 Low
No
No
2025.07.2 17.08.2026 SB20260817112
#VU143913 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-59455
CWE-362 Low
No
No
2025.07.2 17.08.2026 SB20260817112
#VU143912 - Relative Path Traversal
CVE-2025-59456
CWE-23 Low
No
No
2025.07.2 17.08.2026 SB20260817112
#VU143858 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-65907
CWE-94 Medium
No
No
2025.11.6, 2026.1.2 17.08.2026 SB2026081797
#VU143857 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-65906
CWE-94 Medium
No
No
2025.11.6, 2026.1.2 17.08.2026 SB2026081797
#VU143845 - External Control of File Name or Path
CVE-2026-59793
CWE-73 Low
No
No
2026.1.2 17.08.2026 SB2026081797
#VU143844 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-59794
CWE-79 Low
No
No
2026.1.2 17.08.2026 SB2026081797
#VU143843 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-59795
CWE-79 Medium
No
No
2026.1.2 17.08.2026 SB2026081797
#VU143841 - Missing Authorization
CVE-2026-59796
CWE-862 Low
No
No
2026.1.2 17.08.2026 SB2026081797
#VU143818 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-49375
CWE-79 Medium
No
No
2025.11.5, 2026.1 17.08.2026 SB2026081790
#VU143816 - Argument Injection or Modification
CVE-2026-49373
CWE-88 Medium
No
No
2026.1 17.08.2026 SB2026051259
#VU143815 - Server-Side Request Forgery (SSRF)
CVE-2026-49372
CWE-918 Medium
No
No
2025.11.5, 2026.1 17.08.2026 SB2026081790
#VU143814 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-49371
CWE-79 Medium
No
No
2026.1.1 17.08.2026 SB2026081789
#VU140627 - Deserialization of Untrusted Data
CVE-2026-63077
CWE-502 Critical
Available
Exploited
2025.11.7, 2026.1.3 27.07.2026 SB20260731170
#VU131149 - Missing Authentication for Critical Function
CVE-2026-44413
CWE-306 Medium
No
No
2026.1 12.05.2026 SB2026051259


Showing elements 1 - 20 out of 123