Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Aug 20, 2026An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSCVE-2026-43678 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.
- Product
- swift-nio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026LeafKit is a templating language with Swift-inspired syntax.CVE-2026-28499 · Other software · vapor · reported by GitHubMedium 6.9
LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.
- Product
- leaf-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Leafkit is a templating language with Swift-inspired syntax.CVE-2026-27120 · Other software · vapor · reported by GitHubMedium 6.1
Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.
- Product
- leaf-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Vapor is an HTTP web framework for Swift.CVE-2024-21631 · Other software · vapor · reported by GitHubMedium 6.5
Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs. This vulnerability does not affect Vapor directly but could impact applications relying on the URI type for validating user input. The URI type is used in several places in Vapor. A developer may decide to use URI to represent a URL in their application (especially if that URL is then passed to the HTTP Client) and rely on its public properties and methods. However, URI may fail to properly parse a valid (albeit abnormally long) URL, due to string ranges being converted to 16-bit integers. An attacker may use this behavior to trick the application into accepting a URL to an untrusted destination. By padding the port number with zeros, an attacker can cause an integer overflow to occur when the URL authority is parsed and, as a result, spoof the host. Version 4.90.0 contains a patch for this issue. As a workaround, validate user input before parsing as a URI or, if possible, use Foundation's `URL` and `URLComponents` utilities.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023Vapor is an HTTP web framework for Swift.CVE-2023-44386 · Other software · vapor · reported by GitHubMedium 5.3
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023PostgresNIO is a Swift client for PostgreSQL.CVE-2023-31136 · Other software · vapor · reported by GitHubLow 3.7
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.
- Product
- postgres-nio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Vapor is a server-side Swift HTTP web framework.CVE-2022-31019 · Other software · vapor · reported by GitHubHigh 7.5
Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2022Vapor is an HTTP web framework for Swift.CVE-2022-31005 · Other software · vapor · reported by GitHubHigh 7.5
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021Leafkit is a templating language with Swift-inspired syntax.CVE-2021-37634 · Other software · vapor · reported by GitHubHigh 7.4
Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an attacker managed to find a variable that was rendered with their unsanitised data, they could inject scripts into a generated Leaf page, which could enable XSS attacks if other mitigations such as a Content Security Policy were not enabled. This has been patched in 1.3.0. As a workaround sanitize any untrusted input before passing it to Leaf and enable a CSP to block inline script and CSS data.
- Product
- leaf-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021Vapor is a web framework for Swift.CVE-2021-32742 · Other software · vapor · reported by GitHubHigh 7.5
Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2021Vapor is a web framework for Swift.CVE-2021-21328 · Other software · vapor · reported by GitHubMedium 5.3
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020Vapor is a web framework for Swift.CVE-2020-15230 · Other software · vapor · reported by GitHubHigh 8.5
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
- Product
- vapor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.