Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Apr 17, 2026Emissary is a P2P based data-driven workflow engine.CVE-2026-35582 · Other software · NationalSecurityAgency · reported by GitHubHigh 8.8
Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The IN_FILE_ENDING and OUT_FILE_ENDING configuration keys flow directly into these paths, allowing a place author who can write or modify a .cfg file to inject arbitrary shell metacharacters that execute OS commands in the JVM process's security context. The framework already sanitizes placeName via an allowlist before embedding it in the same shell string, but applies no equivalent sanitization to file ending values. No runtime privileges beyond place configuration authorship, and no API or network access, are required to exploit this vulnerability. This is a framework-level defect with no safe mitigation available to downstream implementors, as Executrix provides neither escaping nor documented preconditions against metacharacters in file ending inputs. This issue has been fixed in version 8.43.0.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Emissary is a P2P based data-driven workflow engine.CVE-2026-35583 · Other software · NationalSecurityAgency · reported by GitHubMedium 5.3
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Emissary is a P2P based data-driven workflow engine.CVE-2026-35581 · Other software · NationalSecurityAgency · reported by GitHubHigh 7.2
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Emissary is a P2P based data-driven workflow engine.CVE-2026-35580 · Other software · NationalSecurityAgency · reported by GitHubCritical 9.1
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Emissary is a P2P based data-driven workflow engine.CVE-2026-35571 · Other software · NationalSecurityAgency · reported by GitHubMedium 4.8
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Emissary is a P2P based data-driven workflow engine.CVE-2025-27508 · Other software · NationalSecurityAgency · reported by GitHubHigh 7.5
Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backeCVE-2021-36371 · Other software · Getambassador · reported by MITRELow 3.7
Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend. (2.x versions are unaffected. 1.x versions are unaffected with certain configuration settings involving prune_unreachable_routes and a wildcard Host resource.)
- Product
- Emissary-ingress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021Emissary is a P2P-based, data-driven workflow engine.CVE-2021-32639 · Other software · NationalSecurityAgency · reported by GitHubHigh 7.2
Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround, disable network access to Emissary from untrusted sources.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021Emissary is a P2P based data-driven workflow engine.CVE-2021-32647 · Other software · NationalSecurityAgency · reported by GitHubHigh 8
Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `<constructor>(String, String, String)`. An attacker may find a gadget (class) in the application classpath that could be used to achieve Remote Code Execution (RCE) or disrupt the application. Even though the chances to find a gadget (class) that allow arbitrary code execution are low, an attacker can still find gadgets that could potentially crash the application or leak sensitive data. As a work around disable network access to Emissary from untrusted sources.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Emissary is a distributed, peer-to-peer, data-driven workflow framework.CVE-2021-32634 · Other software · NationalSecurityAgency · reported by GitHubHigh 7.2
Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests to the [`WorkSpaceClientEnqueue.action`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/WorkSpaceClientEnqueueAction.java) REST endpoint. This issue may lead to post-auth Remote Code Execution. This issue has been patched in version 6.5.0. As a workaround, one can disable network access to Emissary from untrusted sources.
- Product
- emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2021The ConfigFileAction component of U.S.CVE-2021-32093 · Other software · NSA · reported by MITREMedium 6.5
The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter.
- Product
- Emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comportswigger.net
May 7, 2021A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S.CVE-2021-32092 · Other software · NSA · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.
- Product
- Emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comportswigger.net
May 7, 2021The ConsoleAction component of U.S.CVE-2021-32096 · Other software · NSA · reported by MITREHigh 8.8
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
- Product
- Emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comportswigger.net
May 7, 2021U.S.CVE-2021-32095 · Other software · NSA · reported by MITREHigh 8.1
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
- Product
- Emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comportswigger.net
May 7, 2021U.S.CVE-2021-32094 · Other software · NSA · reported by MITREHigh 8.8
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
- Product
- Emissary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comportswigger.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.