UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,200
Published in 7 days
233
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,200 vulnerabilities
  1. High 8.1

    CVE-2021-39867 · GitLab

    In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  2. Medium 5.4

    CVE-2021-39866 · GitLab

    A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  3. Medium 5.4

    CVE-2021-39887 · GitLab

    A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  4. Critical 9.8Actively exploited

    CVE-2021-41773 · Apache HTTP Server

    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these…

    Published 5 Oct 2021 · NVD
  5. High 7.5

    CVE-2021-41524 · Apache HTTP Server

    While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

    Published 5 Oct 2021 · NVD
  6. Medium 5.3

    CVE-2021-25118 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Exposure of Sensitive Information to an Unauthorized Actor

    Published 5 Oct 2021 · Fixed in 17.3 · NVD, WPVulnerability
  7. Medium 6.3

    CVE-2021-41089 · Docker Engine

    `docker cp` allows unexpected chmod of host files

    Published 4 Oct 2021 · Fixed in 20.10.9 · NVD, Project advisories (GitHub)
  8. Medium 6.3

    CVE-2021-41091 · Docker Engine

    Insufficiently restricted permissions on data directory

    Published 4 Oct 2021 · Fixed in 20.10.9 · NVD, Project advisories (GitHub)
  9. High 7.5

    CVE-2021-41099 · Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  10. High 8.8

    CVE-2021-32762 · Redis

    Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  11. High 7.5

    CVE-2021-32687 · Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  12. High 7.5

    CVE-2021-32675 · Redis

    Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  13. Medium 4.3

    CVE-2021-32672 · Redis

    Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  14. High 7.5

    CVE-2021-32628 · Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  15. High 7.5

    CVE-2021-32627 · Redis

    Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  16. High 8.8

    CVE-2021-32626 · Redis

    Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  17. Low 2.7

    CVE-2021-39900 · GitLab

    Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  18. Medium 4.2

    CVE-2021-39899 · GitLab

    In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from…

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  19. Low 3.8

    CVE-2021-39896 · GitLab

    In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  20. Medium 5.4

    CVE-2021-39885 · GitLab

    A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious approval rule names

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  21. Medium 4.3

    CVE-2021-39883 · GitLab

    Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  22. Low 3.5

    CVE-2021-39879 · GitLab

    Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication

    Published 4 Oct 2021 · Fixed in 14.1.7 · NVD
  23. Medium 5.5

    CVE-2021-39877 · GitLab

    A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  24. Medium 4.3

    CVE-2021-39874 · GitLab

    In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  25. Medium 4.3

    CVE-2021-39873 · GitLab

    In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  26. Medium 4.3

    CVE-2021-39871 · GitLab

    In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  27. Medium 4.3

    CVE-2021-39868 · GitLab

    In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  28. Medium 6.5

    CVE-2021-22259 · GitLab

    A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.

    Published 4 Oct 2021 · Fixed in 14.1.7 · NVD
  29. Medium 6.5

    CVE-2021-21706 · PHP

    In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

    Published 4 Oct 2021 · Fixed in 7.3.31, 7.4.24, 8.0.11 · NVD
  30. Medium 5.3

    CVE-2021-21705 · PHP

    In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a…

    Published 4 Oct 2021 · Fixed in 7.3.29, 7.4.21, 8.0.8 · NVD
  31. Medium 5.9

    CVE-2021-21704 · PHP

    In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially…

    Published 4 Oct 2021 · Fixed in 7.3.29, 7.4.21, 8.0.8 · NVD
  32. Medium 5.9

    CVE-2021-22947 · curl, MySQL

    When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were…

    Published 29 Sept 2021 · Fixed in 7.79.0 · NVD
  33. High 7.5

    CVE-2021-22946 · curl, MySQL

    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl…

    Published 29 Sept 2021 · Fixed in 7.79.0 · NVD
  34. Medium 6.1

    CVE-2021-41095 · Discourse

    Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, versions 2.8.0.beta6 and earlier of the `beta` branch, and versions 2.8.0.beta6 and earlier of the `tests-passed` branch. Rendering of some error messages that contain user input can be susceptible to XSS attacks. This vulnerability only…

    Published 27 Sept 2021 · NVD
  35. High 7.0

    CVE-2021-41617 · OpenSSH

    sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a…

    Published 26 Sept 2021 · Fixed in 8.8 · NVD
  36. Medium 5.3

    CVE-2020-24327 · Discourse

    Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.

    Published 23 Sept 2021 · NVD
  37. Critical 9.1

    CVE-2021-22945 · curl, MySQL

    When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

    Published 23 Sept 2021 · NVD
  38. Unrated

    WPV-2d0c2ee5a99c · WooCommerce

    Vulnerability in WooCommerce

    Published 22 Sept 2021 · Fixed in 5.7.0 · WPVulnerability
  39. High 7.5

    CVE-2021-41082 · Discourse

    Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The…

    Published 20 Sept 2021 · Fixed in 2021-09-14 · NVD
  40. High 7.5

    CVE-2021-41079 · Apache Tomcat

    Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

    Published 16 Sept 2021 · Fixed in 8.5.64, 9.0.44 · NVD
  41. Critical 9.0Actively exploited

    CVE-2021-40438 · Apache HTTP Server

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

    Published 16 Sept 2021 · NVD
  42. Critical 9.8

    CVE-2021-39275 · Apache HTTP Server

    ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

    Published 16 Sept 2021 · Fixed in 2.4.49 · NVD
  43. High 7.5

    CVE-2021-36160 · Apache HTTP Server

    A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

    Published 16 Sept 2021 · Fixed in 2.4.49 · NVD
  44. High 7.5

    CVE-2021-34798 · Apache HTTP Server

    Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

    Published 16 Sept 2021 · NVD
  45. Medium 5.3

    CVE-2016-20012 · OpenSSH

    OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product

    Published 15 Sept 2021 · NVD
  46. Medium 6.5

    CVE-2021-22147 · Elasticsearch

    Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

    Published 15 Sept 2021 · Fixed in 7.14.0 · NVD
  47. Medium 5.4

    CVE-2021-39201 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress editor

    Published 9 Sept 2021 · Fixed in 5.8 · NVD, WordPress
  48. Medium 6.5

    CVE-2021-39203 · WordPress

    WordPress 5.8 beta: Private data disclosure/privilege escalation through the block editor

    Published 9 Sept 2021 · NVD, WordPress
  49. Medium 5.3

    CVE-2021-39200 · WordPress

    WordPress: Information Disclosure in wp_die() via JSONP, leading to CSRF

    Published 9 Sept 2021 · Fixed in 5.8.1 · NVD, WordPress
  50. Medium 5.4

    CVE-2021-39202 · WordPress

    WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget editor

    Published 9 Sept 2021 · Fixed in 5.8 · NVD, WordPress

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.