Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Jun 17, 2025Teleport provides connectivity, authentication, access controls and audit for infrastructure.CVE-2025-49825 · Other software · gravitational · reported by GitHubCritical 9.8
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
- Product
- teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Teleport: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28855 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Teleport teleport allows Reflected XSS.This issue affects Teleport: from n/a through <= 1.2.4.
- Product
- Teleport
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Teleport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 8, 2022Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.CVE-2022-38599 · Other software · Goteleport · reported by MITREMedium 6.5
Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 24, 2022Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution.CVE-2022-36633 · Other software · Goteleport · reported by MITREHigh 8.8
Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 18, 2021Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or usernamCVE-2021-41395 · Other software · Goteleport · reported by MITREMedium 6.5
Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2021Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.CVE-2021-41394 · Other software · Goteleport · reported by MITREMedium 5.3
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2021Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.CVE-2021-41393 · Other software · Goteleport · reported by MITRECritical 9.8
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2020Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them.CVE-2020-14971 · Other software · Pi-hole · reported by MITREHigh 7.8
Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.gz archive. The attacker then modifies the host parameter in dnsmasq.d files, and then compresses and uploads these files again.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.telspace.co.zagithub.com
Nov 26, 2018tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password.CVE-2018-19555 · Other software · Tp4a · reported by MITREHigh 8.8
tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2018tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.CVE-2018-19301 · Other software · Tp4a · reported by MITREMedium 6.1
tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.
- Product
- Teleport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.