Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,200
- Published in 7 days
- 233
- Critical in 30 days
- 70
- Actively exploited
- 62
Latest vulnerabilities
11,200 vulnerabilities- Medium 4.3
CVE-2021-22249 · GitLab
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD - Medium 5.3
CVE-2021-22248 · GitLab
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only
Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD - Medium 4.3
CVE-2021-22254 · GitLab
Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9.
Published 20 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD - Medium 6.5
CVE-2021-22246 · GitLab
A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks.
Published 20 Aug 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD - Medium 5.4
CVE-2021-22238 · GitLab
An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.
Published 20 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD - High 7.5
CVE-2021-39242 · HAProxy
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.
Published 17 Aug 2021 · Fixed in 2.2.16, 2.3.13, 2.4.3 · NVD - Medium 5.3
CVE-2021-39241 · HAProxy
An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.
Published 17 Aug 2021 · Fixed in 2.2.16, 2.3.13, 2.4.3 · NVD - High 7.5
CVE-2021-39240 · HAProxy
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.
Published 17 Aug 2021 · Fixed in 2.2.16, 2.3.13, 2.4.3 · NVD - High 7.5
CVE-2021-22940 · Node.js
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Published 16 Aug 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD - Medium 5.3
CVE-2021-22939 · Node.js
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Published 16 Aug 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD - Critical 9.8
CVE-2021-22931 · Node.js
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Published 16 Aug 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD - High 7.5
CVE-2021-33193 · Apache HTTP Server
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
Published 16 Aug 2021 · Fixed in 2.4.49 · NVD - Medium 5.4
CVE-2021-34641 · WP Seopress (WordPress plugin)
SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting
Published 16 Aug 2021 · WPVulnerability - Medium 5.4
CVE-2021-36788 · Yoast SEO
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.
Published 13 Aug 2021 · Fixed in 7.2.3 · NVD - Medium 4.3
CVE-2021-37703 · Discourse
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the last read post number and the notification level is exposed.
Published 13 Aug 2021 · Fixed in 2.7.8 · NVD - High 7.5
CVE-2021-37693 · Discourse
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including…
Published 13 Aug 2021 · Fixed in 2.7.8 · NVD - Critical 9.8
CVE-2021-31556 · MediaWiki
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob.
Published 12 Aug 2021 · NVD - Medium 5.5
CVE-2021-34532 · .NET
ASP.NET Core and Visual Studio Information Disclosure Vulnerability
Published 12 Aug 2021 · NVD - Medium 5.0
CVE-2021-34485 · .NET
.NET Core and Visual Studio Information Disclosure Vulnerability
Published 12 Aug 2021 · NVD - High 7.5
CVE-2021-26423 · .NET
.NET Core and Visual Studio Denial of Service Vulnerability
Published 12 Aug 2021 · NVD - Medium 6.1
CVE-2021-37633 · Discourse
Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable` 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy…
Published 9 Aug 2021 · Fixed in 2.7.8 · NVD - Critical 9.1
CVE-2021-29922 · Rust
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
Published 7 Aug 2021 · Fixed in 1.53.0 · NVD - High 7.5
CVE-2021-22926 · curl, MySQL
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will…
Published 5 Aug 2021 · Fixed in 7.78.0 · NVD - Medium 5.3
CVE-2021-22925 · curl, MySQL
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to…
Published 5 Aug 2021 · Fixed in 7.78.0 · NVD - Low 3.7
CVE-2021-22924 · curl, MySQL
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but…
Published 5 Aug 2021 · Fixed in 7.77.0 · NVD - Medium 5.3
CVE-2021-22923 · curl, MySQL
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
Published 5 Aug 2021 · Fixed in 7.78.0 · NVD - Medium 6.5
CVE-2021-22922 · curl, MySQL
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of…
Published 5 Aug 2021 · Fixed in 7.78.0 · NVD - Medium 6.4
CVE-2021-22234 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server.
Published 5 Aug 2021 · NVD - Medium 5.4
CVE-2021-22241 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name.
Published 5 Aug 2021 · Fixed in 14.0.7, 14.1.2 · NVD - Medium 4.3
CVE-2021-22240 · GitLab
Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled
Published 5 Aug 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD - Medium 5.3Actively exploited
CVE-2021-26085 · Confluence
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Published 3 Aug 2021 · Fixed in 7.4.10, 7.12.3 · NVD - High 7.4
CVE-2021-32066 · Ruby
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Published 1 Aug 2021 · NVD - High 7.5
CVE-2021-28966 · Ruby
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
Published 30 Jul 2021 · Fixed in 2.7.3, 3.0.1 · NVD - Medium 4.3
CVE-2021-32788 · Discourse
Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the…
Published 27 Jul 2021 · Fixed in 2.7.7 · NVD - Medium 6.5
CVE-2021-22144 · Elasticsearch
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
Published 26 Jul 2021 · Fixed in 6.8.17, 7.13.3 · NVD - Medium 5.3
CVE-2021-20333 · MongoDB
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10.
Published 23 Jul 2021 · Fixed in 3.6.20, 4.0.21, 4.2.10 · NVD - Medium 6.1
CVE-2021-34630 · Gtranslate (WordPress plugin)
Translate WordPress with GTranslate: Cross-site Scripting
Published 23 Jul 2021 · Fixed in 2.8.65 · WPVulnerability - High 7.5
CVE-2021-36222 · MySQL
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.
Published 22 Jul 2021 · NVD - Medium 4.9
CVE-2021-2444 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2441 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2440 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2437 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD - Low 3.7
CVE-2021-2432 · Java
Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of…
Published 21 Jul 2021 · NVD - Medium 5.9
CVE-2021-2429 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2427 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2426 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2425 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2424 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2422 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…
Published 21 Jul 2021 · NVD - Medium 4.9
CVE-2021-2418 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 21 Jul 2021 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.