Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Mar 31, 2025Zulip server provides an open-source team chat that helps teams stay productive and focused.CVE-2025-27149 · Other software · zulip · reported by GitHubMedium 4.6
Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectly included in all three export types, regardless of if they were used to access the exported organization or not. The "public data" and "with consent" exports metadata including the titles of some topics in private channels which the administrator otherwise did not have access to, and none of the users consented to exporting and metadata for which users were in a group DM together. This vulnerability is fixed in 10.0.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Zulip server provides an open-source team chat that helps teams stay productive and focused.CVE-2024-56136 · Other software · zulip · reported by GitHubMedium 6.9
Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an email address is in use by a user. Zulip Server 9.4 resolves the issue, as does the `main` branch of Zulip Server. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the sCVE-2021-30487 · Other software · Zulip · reported by MITRELow 2.7
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Apr 14, 2021An issue was discovered in Zulip Server before 3.4.CVE-2021-30479 · Other software · Zulip · reported by MITREMedium 5.3
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Apr 14, 2021An issue was discovered in Zulip Server before 3.4.CVE-2021-30478 · Other software · Zulip · reported by MITREMedium 4.3
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Apr 14, 2021An issue was discovered in Zulip Server before 3.4.CVE-2021-30477 · Other software · Zulip · reported by MITREMedium 4.3
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Aug 21, 2020Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted CVE-2020-15070 · Other software · Zulip · reported by MITREHigh 8.8
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Aug 21, 2020Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.CVE-2020-14215 · Other software · Zulip · reported by MITREHigh 7.5
Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Aug 21, 2020Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.CVE-2020-14194 · Other software · Zulip · reported by MITREMedium 5.4
Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Aug 21, 2020Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.CVE-2020-12759 · Other software · Zulip · reported by MITREMedium 6.1
Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Apr 20, 2020Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.CVE-2020-9445 · Other software · Zulip · reported by MITREMedium 6.1
Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Apr 20, 2020Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.CVE-2020-9444 · Other software · Zulip · reported by MITREMedium 6.1
Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Apr 20, 2020Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.CVE-2020-10935 · Other software · Zulip · reported by MITREMedium 5.4
Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgcoresecurity.com
Dec 17, 2019The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.CVE-2019-19775 · Other software · Zulip · reported by MITREMedium 6.1
The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orggithub.com
Nov 21, 2019In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authenticatCVE-2019-18933 · Other software · Zulip · reported by MITRECritical 9.8
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orggithub.com
Sep 18, 2019Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files.CVE-2019-16216 · Other software · Zulip · reported by MITREMedium 5.4
Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack is only effective against browsers lacking support for Content-Security-Policy such as Internet Explorer 11. On a Zulip server using the S3 uploads backend, the attack is confined to the origin of the configured S3 uploads hostname and cannot reach the Zulip server itself.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orggithub.com
Sep 18, 2019The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking.CVE-2019-16215 · Other software · Zulip · reported by MITREMedium 6.5
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orggithub.com
Apr 18, 2018In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend.CVE-2018-9999 · Other software · Zulip · reported by MITREMedium 5.4
In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Apr 18, 2018In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead.CVE-2018-9990 · Other software · Zulip · reported by MITREMedium 6.1
In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Apr 18, 2018In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications.CVE-2018-9987 · Other software · Zulip · reported by MITREMedium 6.1
In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Apr 18, 2018In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.CVE-2018-9986 · Other software · Zulip · reported by MITREMedium 6.1
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orgblog.zulip.org
Nov 27, 2017In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server creaCVE-2017-0910 · Other software · Zulip · reported by support@hackerone.comHigh 8.8
In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.orggithub.com
Jun 2, 2017Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allCVE-2017-0896 · Other software · Zulip · reported by support@hackerone.comMedium 6.5
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Mar 27, 2017An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an aCVE-2017-0881 · Other software · Zulip · reported by support@hackerone.comMedium 4.3
An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.