Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Sep 17, 2026Pomerium is an identity and context-aware access proxy.CVE-2026-50285 · Other software · pomerium · reported by GitHubHigh 7.5
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Pomerium is an identity and context-aware access proxy.CVE-2024-47616 · Other software · pomerium · reported by GitHubMedium 6.8
Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Pomerium is an identity and context-aware access proxy.CVE-2024-39315 · Other software · pomerium · reported by GitHubMedium 5.7
Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the `/.pomerium` endpoint. Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner. Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided the application verifies the Pomerium JWT for each request, the connection between Pomerium and the application is secured by mTLS, or the connection between Pomerium and the application is otherwise secured at the network layer. The issue is patched in Pome
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Pomerium is an identity and context-aware access proxy.CVE-2023-33189 · Other software · pomerium · reported by GitHubCritical 10
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Pomerium is an identity-aware access proxy.CVE-2022-24797 · Other software · pomerium · reported by GitHubMedium 6.5
Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-41230 · Other software · pomerium · reported by GitHubMedium 5.3
Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-39206 · Other software · pomerium · reported by GitHubHigh 8.6
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-39204 · Other software · pomerium · reported by GitHubHigh 7.5
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-39162 · Other software · pomerium · reported by GitHubHigh 8.6
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out processCVE-2021-29652 · Other software · Pomerium · reported by MITREMedium 6.1
Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process
- Product
- Pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).CVE-2021-29651 · Other software · Pomerium · reported by MITREMedium 6.1
Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).
- Product
- Pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.