UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,200
Published in 7 days
233
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,200 vulnerabilities
  1. Medium 4.3

    CVE-2021-22239 · GitLab

    An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.

    Published 9 Sept 2021 · Fixed in 14.0.7, 14.1.2 · NVD
  2. High 7.5

    CVE-2021-40346 · HAProxy

    An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

    Published 8 Sept 2021 · Fixed in 2.2.17, 2.3.14, 2.4.4 · NVD
  3. Medium 6.5

    CVE-2021-28567 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation.

    Published 8 Sept 2021 · NVD
  4. Low 2.7

    CVE-2021-28566 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    Published 8 Sept 2021 · NVD
  5. Critical 9.8

    CVE-2021-32802 · Nextcloud

    Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  6. Medium 5.5

    CVE-2021-32801 · Nextcloud

    Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  7. High 8.1

    CVE-2021-32800 · Nextcloud

    Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  8. Medium 5.3

    CVE-2021-32766 · Nextcloud

    Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  9. High 7.5

    CVE-2021-36044 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.

    Published 1 Sept 2021 · NVD
  10. Medium 6.6

    CVE-2021-36043 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.

    Published 1 Sept 2021 · NVD
  11. High 7.2

    CVE-2021-36042 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

    Published 1 Sept 2021 · NVD
  12. High 7.2

    CVE-2021-36041 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.

    Published 1 Sept 2021 · NVD
  13. High 7.2

    CVE-2021-36040 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.

    Published 1 Sept 2021 · NVD
  14. Medium 6.5

    CVE-2021-36039 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.

    Published 1 Sept 2021 · NVD
  15. Medium 6.5

    CVE-2021-36038 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.

    Published 1 Sept 2021 · NVD
  16. Medium 6.5

    CVE-2021-36037 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.

    Published 1 Sept 2021 · NVD
  17. High 7.2

    CVE-2021-36035 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could make a crafted request to the Adobe Stock API to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  18. High 7.2

    CVE-2021-36034 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  19. High 7.2

    CVE-2021-36033 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  20. High 8.8

    CVE-2021-36032 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.

    Published 1 Sept 2021 · NVD
  21. High 7.2

    CVE-2021-36031 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  22. High 7.5

    CVE-2021-36030 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.

    Published 1 Sept 2021 · NVD
  23. High 7.2

    CVE-2021-36029 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  24. High 7.2

    CVE-2021-36028 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  25. Medium 6.1

    CVE-2021-36027 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 1 Sept 2021 · NVD
  26. Medium 6.1

    CVE-2021-36026 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the…

    Published 1 Sept 2021 · NVD
  27. High 7.2

    CVE-2021-36025 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  28. High 7.2

    CVE-2021-36024 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  29. High 7.2

    CVE-2021-36022 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  30. Critical 9.8

    CVE-2021-36020 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  31. Medium 6.5

    CVE-2021-36012 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.

    Published 1 Sept 2021 · NVD
  32. Critical 9.8Actively exploited

    CVE-2021-26084 · Confluence

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

    Published 30 Aug 2021 · Fixed in 7.4.11, 7.11.6, 7.12.5 · NVD
  33. Medium 4.8

    CVE-2021-24569 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 30 Aug 2021 · Fixed in 2.1.4 · WPVulnerability
  34. Medium 5.4

    CVE-2021-39161 · Discourse

    Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This…

    Published 26 Aug 2021 · Fixed in 2.7.8 · NVD
  35. Medium 5.4

    CVE-2021-22256 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  36. Medium 5.4

    CVE-2021-22250 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  37. Medium 4.3

    CVE-2021-22247 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  38. Low 2.7

    CVE-2021-22245 · GitLab

    Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  39. Medium 6.5

    CVE-2021-22244 · GitLab

    Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  40. Medium 4.3

    CVE-2021-22243 · GitLab

    Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  41. Medium 5.4

    CVE-2021-22242 · GitLab

    Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  42. Medium 4.9

    CVE-2021-22237 · GitLab

    Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  43. High 8.8

    CVE-2021-22236 · GitLab

    Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.

    Published 25 Aug 2021 · Fixed in 14.1.2 · NVD
  44. Unrated

    WPV-fc28a35cc350 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 25 Aug 2021 · Fixed in 5.10 · WPVulnerability
  45. High 7.4

    CVE-2021-3712 · OpenSSL, MySQL

    ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i"…

    Published 24 Aug 2021 · Fixed in 1.0.2za, 1.1.1l · NVD
  46. Critical 9.8

    CVE-2021-3711 · OpenSSL, MySQL

    In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized…

    Published 24 Aug 2021 · Fixed in 1.1.1l · NVD
  47. Critical 9.1

    CVE-2021-26040 · Joomla!

    An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

    Published 24 Aug 2021 · NVD
  48. Medium 5.4

    CVE-2021-22253 · GitLab

    Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  49. Medium 6.5

    CVE-2021-22252 · GitLab

    A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  50. Medium 4.3

    CVE-2021-22251 · GitLab

    Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.