In JetBrains TeamCity prior to 2021.1.2, email notifications could include unescaped HTML for XSS.
jetbrains teamcity