Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
285 results · page 2 of 6
Jul 28, 2025In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsCVE-2025-54535 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.8
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset pageCVE-2025-54534 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configurationCVE-2025-54533 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependenciesCVE-2025-54532 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on WindowsCVE-2025-54531 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissionsCVE-2025-54530 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integrationCVE-2025-54529 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.7
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flowCVE-2025-54528 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possibleCVE-2025-52879 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissionsCVE-2025-52878 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possibleCVE-2025-52877 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possibleCVE-2025-52876 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possibleCVE-2025-52875 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root pageCVE-2025-47854 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possibleCVE-2025-47853 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possibleCVE-2025-47852 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleCVE-2025-47851 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tabCVE-2025-46618 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possibleCVE-2025-46433 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.9
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logsCVE-2025-46432 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles pageCVE-2025-31141 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pageCVE-2025-31140 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build logCVE-2025-31139 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tabCVE-2025-26493 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resourcesCVE-2025-26492 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpointCVE-2025-24461 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent poolCVE-2025-24460 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection pageCVE-2025-24459 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attackCVE-2024-56356 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSSCVE-2024-56355 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permissionCVE-2024-56354 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookiesCVE-2024-56353 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details pageCVE-2024-56352 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user rolesCVE-2024-56351 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projectsCVE-2024-56350 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logsCVE-2024-56349 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agentsCVE-2024-56348 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settingsCVE-2024-47951 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settingsCVE-2024-47950 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary locationCVE-2024-47949 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.9
In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backupsCVE-2024-47948 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.9
In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST APICVE-2024-47161 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core pluginCVE-2024-43810 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset pageCVE-2024-43809 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault pluginCVE-2024-43808 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.7
In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds pageCVE-2024-43807 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissionsCVE-2024-43114 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2024In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connectionCVE-2024-41829 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 22, 2024In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeCVE-2024-41828 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.6
In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 22, 2024In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expirationCVE-2024-41827 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.