CVE-2026-111095High· 8.0▾ TwilightIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
teamcity < 2025.11.8teamcity >= 2026.1, < 2026.1.4Upgrade past the affected range:
teamcity 2026.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111096Medium· 6.7In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
CVE-2025-67741Medium· 4.6In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
CVE-2026-123288Medium· 5.4In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
CVE-2026-123301High· 8.2In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
CVE-2026-123309Medium· 6.1In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
CVE-2026-111094High· 8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible