CVE-2026-59794: In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

Details

Source

NVD Recent CVEs (US · database · site)

Severity

high — CVSS 7.3

Published

2026-07-10

Last updated

2026-07-10

Exploitation

Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59794

Referenced CVEs

Recent advisories for In JetBrains TeamCity

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• highCVE-2026-59796: In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permi…nvd · 2026-07-10
• highCVE-2026-59795: In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was po…nvd · 2026-07-10
• highCVE-2026-59793: In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS …nvd · 2026-07-10
• criticalexploitedCVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerabilitycisa-kev · 2026-04-20
• criticalexploitedCVE-2024-27198: JetBrains TeamCity Authentication Bypass Vulnerabilitycisa-kev · 2024-03-07
• criticalexploitedCVE-2023-42793: JetBrains TeamCity Authentication Bypass Vulnerabilitycisa-kev · 2023-10-04

More from NVD Recent CVEs

• unknownCVE-2026-57828: The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload t…2026-07-11
• unknownCVE-2026-57827: The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that al…2026-07-11
• highCVE-2026-1359: The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized m…2026-07-11
• highCVE-2026-9282: The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up…2026-07-11
• mediumCVE-2026-9017: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to autho…2026-07-11