Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Jul 31, 2026OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2026-54707 · Other software · onionshare · reported by GitHubMedium 5.4
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2026-54706 · Other software · onionshare · reported by GitHubMedium 4.8
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21694 · Other software · onionshare · reported by GitHubLow 3.7
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21692 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21690 · Other software · onionshare · reported by GitHubHigh 8.7
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21695 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21693 · Other software · onionshare · reported by GitHubMedium 6.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions an adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced. This can be mitigated by usage of the flatpak release.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21691 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21689 · Other software · onionshare · reported by GitHubHigh 7.5
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions the receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21688 · Other software · onionshare · reported by GitHubHigh 7.5
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated. This issue has been patched in version 2.5.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21696 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.CVE-2021-41868 · Other software · Onionshare · reported by MITRECritical 9.8
OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.
- Product
- Onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-CVE-2021-41867 · Other software · Onionshare · reported by MITREMedium 5.3
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Product
- Onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2018The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which mighCVE-2018-19960 · Other software · Onionshare · reported by MITREHigh 7
The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.
- Product
- Onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugs.debian.org
Jan 30, 2017hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.CVE-2016-5026 · Other software · Onionshare · reported by MITREMedium 5.5
hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.
- Product
- Onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.