CVE-2026-49378

MediumCVSS 4.3/10Last modified Jul 22, 2026

Description

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-493796.5In JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesCVE-2026-49386.5IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access ContainerCVE-2026-493806.1In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possibleCVE-2026-493814.8In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleCVE-2026-493827.8In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright pluginCVE-2026-493833.3In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possibleCVE-2026-493846.1In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possibleCVE-2026-493856.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accountsCVE-2026-493866.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning CanvasCVE-2026-493915.1Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before CVE-2026-493925.3Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::gCVE-2026-493947.1Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Worksp
CVE-2026-49378: Medium severity, CVSS 4.3 | Vulnix