Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Sep 15, 2026@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in theCVE-2026-92299 · Other software · Jitsi · reported by VulnCheckHigh 7.1
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.
- Product
- @jitsi/electron-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Jitsi Meet is an open source video conferencing application.CVE-2025-64754 · Other software · jitsi · reported by GitHubLow 2.7
Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
- Product
- jitsi-meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitraryCVE-2024-44081 · Other software · jitsi · reported by MITRECritical 9.8
In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format.
- Product
- meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arCVE-2024-44080 · Other software · jitsi · reported by MITREHigh 7.5
In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arbitrary URL if a message from another participant contains a URL encoded in the expected format.
- Product
- meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024WordPress Jitsi Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3978 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WordPress Jitsi Shortcode
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WordPress Jitsi Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024WordPress Jitsi Shortcode: Does not sanitise and escape some of its settingsCVE-2024-3977 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Jitsi Shortcode
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WordPress Jitsi Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2024In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a uCVE-2024-33530 · Other software · jitsi · reported by MITREHigh 7.5
In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby.
- Product
- meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsinuator.netinsinuator.net
Mar 29, 2024Webinar and Video Conference with Jitsi Meet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30437 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3.
- Product
- Webinar and Video Conference with Jitsi Meet
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Webinar and Video Conference with Jitsi Meet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 9, 2023A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow anCVE-2022-43550 · Other software · Jitsi · reported by support@hackerone.comCritical 9.8
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.
- Product
- Jitsi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request.CVE-2022-36736 · Other software · Jitsi · reported by MITREMedium 6.1
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor
- Product
- Jitsi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Jitsi Meet is an open source video conferencing application.CVE-2021-39215 · Other software · jitsi · reported by GitHubHigh 7.5
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.
- Product
- jitsi-meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021Jitsi Meet is an open source video conferencing application.CVE-2021-39205 · Other software · jitsi · reported by GitHubMedium 6.8
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
- Product
- jitsi-meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2021jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default.CVE-2021-33506 · Other software · 8x8 · reported by MITREHigh 7.5
jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conference moderation.
- Product
- Jitsi Meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module.CVE-2021-26812 · Other software · Jitsi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application.
- Product
- Meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2020jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or httpsCVE-2020-25019 · Other software · Jitsi · reported by MITREHigh 7.5
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
- Product
- Meet Electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2020The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.CVE-2020-11878 · Other software · Jitsi · reported by MITRECritical 9.8
The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.
- Product
- Meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2017An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in theCVE-2017-5603 · Other software · Jitsi · reported by MITREMedium 5.9
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
- Product
- Jitsi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.