TE
DevOps
TeamCity
On CISA KEVExploited in the wildRansomware-linked
284
CVEs
4
On KEV
10.0
Max CVSS
8
New 30D
Severity mix
Critical 30High 59Medium 184Low 9
Watch
Add TeamCity to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-57733 | 3.8 | Aug 20 | In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content Affected: before 2025.07.1 |
| CVE-2021-25775 | 3.8 | Feb 3 | In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users Affected: before 2020.2.1 |
| CVE-2021-26309 | 3.3 | May 11 | Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions Affected: before 2020.2.2.85899 |
| CVE-2025-67739 | 3.1 | Dec 11 | In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure Affected: before 2025.11.2 |
| CVE-2025-68164 | 2.7 | Dec 16 | In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test Affected: before 2025.11 |
| CVE-2025-68162 | 2.7 | Dec 16 | In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration Affected: before 2025.11 |
| CVE-2021-31906 | 2.7 | May 11 | In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file Affected: before 2020.2.2 |
| CVE-2020-11686 | 2.7 | Apr 22 | In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings Affected: before 2019.1.4 |
| CVE-2026-28196 | 2.3 | Feb 25 | In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk Affected: before 2025.11.3 |
Showing 9