CVE-2026-49380

MediumCVSS 6.1/10Last modified Jul 22, 2026

Description

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-493814.8In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleCVE-2026-493827.8In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright pluginCVE-2026-493833.3In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possibleCVE-2026-493846.1In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possibleCVE-2026-493856.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accountsCVE-2026-493866.5In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning CanvasCVE-2026-493915.1Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before CVE-2026-493925.3Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::gCVE-2026-493947.1Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in WorkspCVE-2026-493967.1Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14,CVE-2026-493975.3Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14,CVE-2026-494003.3October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMa