Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,229
- Published in 7 days
- 255
- Critical in 30 days
- 70
- Actively exploited
- 62
Latest vulnerabilities
11,229 vulnerabilities- Critical 9.8
CVE-2021-36126 · MediaWiki
An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user.
Published 2 Jul 2021 · NVD - High 7.5
CVE-2021-36125 · MediaWiki
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial of service attacks when a user's current username is beyond an arbitrary maximum configuration value (MaxNameChars).
Published 2 Jul 2021 · NVD - High 7.5
CVE-2021-35197 · MediaWiki
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).
Published 2 Jul 2021 · Fixed in 1.31.15, 1.35.3, 1.36.1 · NVD - Medium 5.3
CVE-2021-28585 · Magento / Adobe Commerce
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.
Published 28 Jun 2021 · Fixed in 2.3.6 · NVD - High 7.2
CVE-2021-28584 · Magento / Adobe Commerce
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 28 Jun 2021 · Fixed in 2.3.6 · NVD - Medium 4.2
CVE-2021-28583 · Magento / Adobe Commerce
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.
Published 28 Jun 2021 · Fixed in 2.3.6 · NVD - Medium 6.5
CVE-2021-28563 · Magento / Adobe Commerce
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Published 28 Jun 2021 · Fixed in 2.3.7 · NVD - Medium 4.8
CVE-2021-28556 · Magento / Adobe Commerce
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.
Published 28 Jun 2021 · Fixed in 2.3.7 · NVD - Medium 6.1
CVE-2021-24452 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Cross-site Scripting
Published 28 Jun 2021 · Fixed in 2.1.5 · WPVulnerability - Medium 6.1
CVE-2021-24436 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Cross-site Scripting
Published 28 Jun 2021 · Fixed in 2.1.4 · WPVulnerability - Low 3.7
CVE-2021-32823 · GitLab
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the…
Published 24 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Critical 9.8
CVE-2010-1435 · Joomla!
Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Published 21 Jun 2021 · NVD - High 7.5
CVE-2010-1434 · Joomla!
Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Published 21 Jun 2021 · NVD - Critical 9.8
CVE-2010-1433 · Joomla!
Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. Joomla! Core versions…
Published 21 Jun 2021 · NVD - High 7.5
CVE-2010-1432 · Joomla!
Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Published 21 Jun 2021 · NVD - High 7.5
CVE-2021-31618 · Apache HTTP Server
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2…
Published 15 Jun 2021 · NVD - Medium 5.5
CVE-2021-32553 · Java
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
Published 12 Jun 2021 · NVD - Critical 9.8
CVE-2021-22915 · Nextcloud
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection.
Published 11 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD - High 8.1
CVE-2021-22901 · curl, MySQL
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL,…
Published 11 Jun 2021 · NVD - Low 3.1
CVE-2021-22898 · curl, MySQL
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing…
Published 11 Jun 2021 · Fixed in 5.7.34, 8.0.25 · NVD - Medium 5.3
CVE-2021-22897 · curl, MySQL
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets…
Published 11 Jun 2021 · NVD - Medium 6.5
CVE-2021-22181 · GitLab
A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources.
Published 11 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Critical 9.8Actively exploited
CVE-2021-22175 · GitLab
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
Published 11 Jun 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD - Medium 5.3
CVE-2021-30641 · Apache HTTP Server
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
Published 10 Jun 2021 · NVD - Critical 9.8
CVE-2021-26691 · Apache HTTP Server
In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
Published 10 Jun 2021 · NVD - High 7.5
CVE-2021-26690 · Apache HTTP Server
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service
Published 10 Jun 2021 · NVD - High 7.3
CVE-2020-35452 · Apache HTTP Server
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero…
Published 10 Jun 2021 · NVD - High 7.5
CVE-2020-13950 · Apache HTTP Server
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service
Published 10 Jun 2021 · NVD - Medium 5.5
CVE-2020-13938 · Apache HTTP Server
Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows
Published 10 Jun 2021 · NVD - Medium 5.3
CVE-2019-17567 · Apache HTTP Server
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.
Published 10 Jun 2021 · NVD - Medium 5.9
CVE-2021-31957 · .NET
ASP.NET Core Denial of Service Vulnerability
Published 8 Jun 2021 · NVD - Medium 5.4
CVE-2021-22220 · GitLab
An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks.
Published 8 Jun 2021 · NVD - Medium 6.5
CVE-2021-22216 · GitLab
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description
Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Medium 6.5
CVE-2021-22221 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired
Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Medium 4.9
CVE-2021-22219 · GitLab
All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking.
Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Medium 6.5
CVE-2021-22217 · GitLab
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request
Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Medium 6.5
CVE-2021-22213 · GitLab
A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari
Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Low 2.6
CVE-2021-22218 · GitLab
All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits.
Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Low 2.7
CVE-2021-22215 · GitLab
An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects
Published 8 Jun 2021 · Fixed in 13.11.5, 13.12.2 · NVD - High 8.6
CVE-2021-22214 · GitLab
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited
Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD - Critical 9.8
CVE-2017-20005 · nginx
NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.
Published 6 Jun 2021 · Fixed in 1.13.6 · NVD - Medium 5.5
CVE-2021-3522 · Java
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
Published 2 Jun 2021 · NVD - Medium 4.3
CVE-2021-32657 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use…
Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD - High 8.6
CVE-2021-32656 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other…
Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD - Low 3.5
CVE-2021-32655 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently…
Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD - Critical 9.1
CVE-2021-32654 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround,…
Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD - Low 2.7
CVE-2021-32653 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist.
Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD - High 8.8
CVE-2021-32027 · PostgreSQL
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Published 1 Jun 2021 · Fixed in 11.12, 12.7, 13.3 · NVD - High 7.7
CVE-2021-23017 · nginx, OpenResty
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
Published 1 Jun 2021 · Fixed in 1.19.3.2, 1.20.1 · NVD - Medium 5.3
CVE-2021-24374 · Jetpack
Jetpack – WP Security, Backup, Speed, & Growth: Authorization Bypass Through User-Controlled Key
Published 1 Jun 2021 · Fixed in 9.8 · NVD, WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.