Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
30 results
Oct 26, 2026A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of privCVE-2026-111590 · Other software · Harbor · reported by cret@cert.org
A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials.CVE-2026-92770 · Other software · goharbor · reported by VulnCheckHigh 7.1
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.
- Product
- harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.CVE-2026-4404 · Other software · Harbor · reported by cret@cert.orgCritical 9.4
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jul 25, 2025CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/uCVE-2025-30086 · Other software · reported by MITREMedium 4.9
CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025Harbor is an open source trusted cloud native registry project that stores, signs, and scans content.CVE-2025-32019 · Other software · goharbor · reported by GitHubMedium 4.1
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
- Product
- harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs.CVE-2022-31671 · Computers, phones & browsers · Linuxfoundation · reported by security@vmware.comHigh 7.4
Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Harbor fails to validate the user permissions when updating tag retention policies.CVE-2022-31670 · Computers, phones & browsers · Linuxfoundation · reported by security@vmware.comHigh 7.7
Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag retention policies configured in other projects.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Harbor fails to validate the user permissions when updating tag immutability policies.CVE-2022-31669 · Computers, phones & browsers · Linuxfoundation · reported by security@vmware.comMedium 6.4
Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Harbor fails to validate the user permissions when updating p2p preheat policies.CVE-2022-31668 · Computers, phones & browsers · Linuxfoundation · reported by security@vmware.comHigh 7.4
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.CVE-2022-31667 · Computers, phones & browsers · Linuxfoundation · reported by security@vmware.comMedium 6.4
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users.CVE-2022-31666 · Computers, phones & browsers · Linuxfoundation · reported by security@vmware.comHigh 7.7
Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to eCVE-2024-51419 · Other software · shenzhen_interconnection_harbor_network_technology · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code.
- Product
- ofweek_online_exhibition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.CVE-2024-22278 · Other software · harbor · reported by security@vmware.comMedium 6.4
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
- Product
- harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SQL-Injection in Harbor allows priviledge users to leak the task IDsCVE-2024-22261 · Other software · Harbor · reported by security@vmware.comLow 2.7
SQL-Injection in Harbor allows priviledge users to leak the task IDs
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.CVE-2024-22244 · Other software · Harbor · reported by security@vmware.comMedium 4.3
Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network acceCVE-2023-20902 · Other software · Harbor · reported by security@vmware.comMedium 5.9
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.
- Product
- Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023FareHarbor: Stored Cross-Site ScriptingCVE-2023-5252 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FareHarbor
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update FareHarbor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 12, 2023An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication.CVE-2022-46463 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP sCVE-2019-19030 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 5.3
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2021In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.CVE-2020-29662 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 5.3
In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.CVE-2020-13794 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 4.3
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's CVE-2020-13788 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 4.3
Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2020Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal PCVE-2019-19029 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.2
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2020Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the PivotaCVE-2019-19026 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 4.9
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2020Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.CVE-2019-19025 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 8.8
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2020Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the PivotCVE-2019-19023 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 8.8
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtanzu.vmware.com
Dec 3, 2019A User Enumeration flaw exists in Harbor.CVE-2019-3990 · Computers, phones & browsers · Linuxfoundation · reported by vulnreport@tenable.comMedium 4.3
A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2019Harbor API has a Broken Access Control vulnerability.CVE-2019-16919 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2019core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authCVE-2019-16097 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 6.5
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2017The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.CVE-2017-17697 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 8.6
The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.