Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Oct 23, 2026Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.CVE-2026-57210 · Other software · dadrus · reported by GitHubHigh 7
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
- Product
- heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.CVE-2026-57209 · Other software · dadrus · reported by GitHubHigh 7
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.
- Product
- heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats reqCVE-2026-107449 · Computers, phones & browsers · linuxserver · reported by MITRELow 3.4
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
- Product
- Heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpCVE-2026-82477 · Other software · MITRE · reported by MITREMedium 5.8
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.
- Product
- Heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability.CVE-2026-18274 · Other software · Heimdall Data · reported by zdi-disclosures@trendmicro.comHigh 7.2
Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadJar method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28603.
- Product
- Database Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability.CVE-2026-12357 · Other software · Heimdall Data · reported by zdi-disclosures@trendmicro.comHigh 7.2
Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateFileContent function. The issue results from the lack of proper neutralization of CRLF sequences. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29251.
- Product
- Database Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.CVE-2026-42274 · Other software · dadrus · reported by GitHubHigh 7.8
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.
- Product
- heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.CVE-2026-42273 · Other software · dadrus · reported by GitHubHigh 7.8
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14.
- Product
- heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.CVE-2026-42272 · Other software · dadrus · reported by GitHubHigh 7.8
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.
- Product
- heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.CVE-2026-32811 · Other software · dadrus · reported by GitHubHigh 8.2
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-alpha through 0.17.10, wrong encoding of the query URL string allows rules with non-wildcard path expressions to be bypassed. Envoy splits the requested URL into parts, and sends the parts individually to Heimdall. Although query and path are present in the API, the query field is documented to be always empty and the URL query is included in the path field. The implementation uses go's url library to reconstruct the url which automatically encodes special characters in the path. As a consequence, a parameter like /mypath?foo=bar to Path is escaped into /mypath%3Ffoo=bar. Subsequently, a rule matching /mypath no longer matches and is bypassed. The issue can only lead to unintended access if Heimdall is configured with an "allow all" default rule. Since v0.16.0, Heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via --insecure-skip-secure-default-rule-enforcement or the broader --insecure flag. This issue has been fixed in version 0.17.11.
- Product
- heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability.CVE-2025-12486 · Other software · Heimdall Data · reported by zdi-disclosures@trendmicro.comHigh 8.8
Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the handling of the database event logs. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-24755.
- Product
- Database Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`.CVE-2025-50578 · Computers, phones & browsers · Linuxserver · reported by MITRECritical 9.8
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application.
- Product
- Docker-heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.CVE-2025-54597 · Computers, phones & browsers · LinuxServer · reported by MITREHigh 7.2
LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.
- Product
- Heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application.CVE-2024-51358 · Computers, phones & browsers · linuxserver · reported by MITRECritical 9.8
An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application.
- Product
- heimdall_application_dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2024LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.CVE-2023-51803 · Computers, phones & browsers · linuxserver · reported by MITRECritical 9.8
LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.
- Product
- heimdall_application_dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page.CVE-2022-47968 · Computers, phones & browsers · Linuxserver · reported by MITREMedium 5.4
Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
- Product
- Heimdall Application Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.