Patchfirst: JetBrains vulnerabilitieshttps://patchfirst.co/vendor/jetbrains/New and newly exploited JetBrains CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-111094: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build…https://patchfirst.co/cve/CVE-2026-111094/CVE-2026-111094Thu, 15 Oct 2026 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 0.4% (higher than 33.3% of CVEs). CVSS 9.8 CRITICAL. Priority 15.7 of 100.CVE-2026-108474: In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionshttps://patchfirst.co/cve/CVE-2026-108474/CVE-2026-108474Sat, 10 Oct 2026 00:00:00 GMTJetBrains · Exposed. Not in CISA KEV. EPSS 0.3% (higher than 24.9% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-106218: In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possiblehttps://patchfirst.co/cve/CVE-2026-106218/CVE-2026-106218Tue, 06 Oct 2026 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 0.3% (higher than 24.9% of CVEs). CVSS 10.0 CRITICAL. Priority 14.2 of 100.[KEV] CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-63077/CVE-2026-63077#kevWed, 05 Aug 2026 00:00:00 GMTJetBrains · TeamCity. In CISA KEV since 2026-08-05, known ransomware use. ENISA EUVD lists it as exploited. EPSS 93.6% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 89.8 of 100.kevransomwarepublic-exploitT1190T1059[KEV] CVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerabilityhttps://patchfirst.co/cve/CVE-2024-27199/CVE-2024-27199#kevMon, 20 Apr 2026 00:00:00 GMTJetBrains · TeamCity. In CISA KEV since 2026-04-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.1 of 100.kevransomwarepublic-exploitT1190T1078CVE-2025-46618: In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tabhttps://patchfirst.co/cve/CVE-2025-46618/CVE-2025-46618Fri, 25 Apr 2025 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 63.0% (higher than 99.2% of CVEs). CVSS 3.5 LOW. Priority 22.3 of 100.CVE-2024-31138: In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingshttps://patchfirst.co/cve/CVE-2024-31138/CVE-2024-31138Thu, 28 Mar 2024 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 74.7% (higher than 99.5% of CVEs). CVSS 4.6 MEDIUM. Priority 23.1 of 100.[KEV] CVE-2024-27198: JetBrains TeamCity Authentication Bypass Vulnerabilityhttps://patchfirst.co/cve/CVE-2024-27198/CVE-2024-27198#kevThu, 07 Mar 2024 00:00:00 GMTJetBrains · TeamCity. In CISA KEV since 2024-03-07, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059CVE-2024-23917: In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possiblehttps://patchfirst.co/cve/CVE-2024-23917/CVE-2024-23917Tue, 06 Feb 2024 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 54.0% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 67.3 of 100.public-exploit[KEV] CVE-2023-42793: JetBrains TeamCity Authentication Bypass Vulnerabilityhttps://patchfirst.co/cve/CVE-2023-42793/CVE-2023-42793#kevWed, 04 Oct 2023 00:00:00 GMTJetBrains · TeamCity. In CISA KEV since 2023-10-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.003 Windows Command Shell. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059.003CVE-2023-41249: In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Stephttps://patchfirst.co/cve/CVE-2023-41249/CVE-2023-41249Fri, 25 Aug 2023 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 55.5% (higher than 99.03% of CVEs). CVSS 4.6 MEDIUM. Priority 23.0 of 100.CVE-2023-34220: In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possiblehttps://patchfirst.co/cve/CVE-2023-34220/CVE-2023-34220Wed, 31 May 2023 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 61.4% (higher than 99.16% of CVEs). CVSS 4.6 MEDIUM. Priority 23.1 of 100.CVE-2023-34225: In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possiblehttps://patchfirst.co/cve/CVE-2023-34225/CVE-2023-34225Wed, 31 May 2023 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 4.6 MEDIUM. Priority 23.0 of 100.CVE-2022-48428: In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possiblehttps://patchfirst.co/cve/CVE-2022-48428/CVE-2022-48428Mon, 27 Mar 2023 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 68.0% (higher than 99.32% of CVEs). CVSS 4.6 MEDIUM. Priority 23.1 of 100.CVE-2022-48343: In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation processhttps://patchfirst.co/cve/CVE-2022-48343/CVE-2022-48343Thu, 23 Feb 2023 00:00:00 GMTJetBrains · TeamCity. Not in CISA KEV. EPSS 59.5% (higher than 99.12% of CVEs). CVSS 5.4 MEDIUM. Priority 23.6 of 100.