Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
344new WordPress flaws this week
390,080entries in the database

285 results · page 5 of 6

  • Feb 25, 2022In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.CVE-2022-24336 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 25, 2022JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.CVE-2022-24335 · Other software · Jetbrains · reported by MITREHigh 8.1

    JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 25, 2022In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.CVE-2022-24334 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 25, 2022In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.CVE-2022-24333 · Other software · Jetbrains · reported by MITREMedium 6.5

    In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 25, 2022In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.CVE-2022-24332 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 25, 2022In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.CVE-2022-24331 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 25, 2022In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.CVE-2022-24330 · Other software · Jetbrains · reported by MITREMedium 6.1

    In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 30, 2021In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.CVE-2021-43202 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.CVE-2021-43201 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.CVE-2021-43200 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.CVE-2021-43199 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.2, stored XSS is possible.CVE-2021-43198 · Other software · Jetbrains · reported by MITREMedium 5.4

    In JetBrains TeamCity before 2021.1.2, stored XSS is possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.CVE-2021-43197 · Other software · Jetbrains · reported by MITREMedium 6.1

    In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.CVE-2021-43196 · Other software · Jetbrains · reported by MITREHigh 7.5

    In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.CVE-2021-43195 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.2, user enumeration was possible.CVE-2021-43194 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.1.2, user enumeration was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2021In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.CVE-2021-43193 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 6, 2021In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.CVE-2021-37548 · Other software · Jetbrains · reported by MITREHigh 7.5

    In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 6, 2021In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.CVE-2021-37547 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 6, 2021In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.CVE-2021-37546 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 6, 2021In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.CVE-2021-37545 · Other software · Jetbrains · reported by MITREHigh 7.5

    In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 6, 2021In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.CVE-2021-37544 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 6, 2021In JetBrains TeamCity before 2020.2.3, XSS was possible.CVE-2021-37542 · Other software · Jetbrains · reported by MITREMedium 6.1

    In JetBrains TeamCity before 2020.2.3, XSS was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.CVE-2021-31915 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.CVE-2021-31914 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.CVE-2021-31913 · Other software · Jetbrains · reported by MITREHigh 7.5

    In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.CVE-2021-31912 · Other software · Jetbrains · reported by MITREHigh 8.8

    In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.CVE-2021-31911 · Other software · Jetbrains · reported by MITREMedium 6.1

    In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.CVE-2021-31910 · Other software · Jetbrains · reported by MITREHigh 7.5

    In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.CVE-2021-3315 · Other software · Jetbrains · reported by MITREMedium 5.4

    In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.CVE-2021-31909 · Other software · Jetbrains · reported by MITRECritical 9.8

    In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.CVE-2021-31908 · Other software · Jetbrains · reported by MITREMedium 5.4

    In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.CVE-2021-31907 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.CVE-2021-31906 · Other software · Jetbrains · reported by MITRELow 2.7

    In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.CVE-2021-31904 · Other software · Jetbrains · reported by MITREMedium 6.1

    In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.CVE-2021-26310 · Other software · Jetbrains · reported by MITREHigh 7.5

    In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 11, 2021Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.CVE-2021-26309 · Other software · Jetbrains · reported by MITRELow 3.3

    Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.CVE-2021-25778 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.CVE-2021-25777 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.CVE-2021-25776 · Other software · Jetbrains · reported by MITREHigh 7.5

    In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.CVE-2021-25775 · Other software · Jetbrains · reported by MITRELow 3.8

    In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.CVE-2021-25774 · Other software · Jetbrains · reported by MITREMedium 4.3

    In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.CVE-2021-25773 · Other software · Jetbrains · reported by MITREMedium 6.1

    JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.CVE-2021-25772 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2021JetBrains TeamCity Plugin before 2020.2.85695 SSRF.CVE-2020-35667 · Other software · Jetbrains · reported by MITREHigh 7.5

    JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 16, 2020JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.CVE-2020-27627 · Other software · Jetbrains · reported by MITREMedium 6.1

    JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 16, 2020In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.CVE-2020-27629 · Other software · Jetbrains · reported by MITREMedium 5.3

    In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 16, 2020In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.CVE-2020-27628 · Other software · Jetbrains · reported by MITREMedium 4.3

    In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 8, 2020JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.CVE-2020-15831 · Other software · Jetbrains · reported by MITREMedium 6.1

    JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 8, 2020JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.CVE-2020-15830 · Other software · Jetbrains · reported by MITREMedium 6.1

    JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.

    Product
    Teamcity
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.