UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,229
Published in 7 days
248
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,229 vulnerabilities
  1. Critical 9.0

    CVE-2020-15180 · MariaDB

    A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before…

    Published 27 May 2021 · Fixed in 10.3.25, 10.4.15, 10.5.6 · NVD
  2. Medium 6.5

    CVE-2021-26034 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.

    Published 26 May 2021 · NVD
  3. Medium 6.5

    CVE-2021-26033 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.

    Published 26 May 2021 · NVD
  4. Medium 6.1

    CVE-2021-26032 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.

    Published 26 May 2021 · NVD
  5. Medium 5.7

    CVE-2021-3426 · Python

    There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions…

    Published 20 May 2021 · Fixed in 3.7.10, 3.8.8, 3.9.3 · NVD
  6. High 8.6

    CVE-2021-3517 · Java

    There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an…

    Published 19 May 2021 · NVD
  7. Medium 5.9

    CVE-2021-3537 · Java

    A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

    Published 14 May 2021 · NVD
  8. High 7.2

    CVE-2021-24312 · WP Super Cache (WordPress plugin)

    WP Super Cache: OS Command Injection

    Published 14 May 2021 · Fixed in 1.7.3 · WPVulnerability
  9. Medium 5.3

    CVE-2021-22137 · Elasticsearch

    In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker…

    Published 13 May 2021 · Fixed in 6.8.15, 7.11.2 · NVD
  10. Medium 5.3

    CVE-2021-22135 · Elasticsearch

    Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to…

    Published 13 May 2021 · Fixed in 6.8.15, 7.11.2 · NVD
  11. Low 3.3

    CVE-2020-14354 · c-ares

    A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

    Published 13 May 2021 · NVD
  12. High 7.3

    CVE-2021-31204 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 11 May 2021 · NVD
  13. Medium 4.8

    CVE-2021-24423 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 9 May 2021 · Fixed in 1.6.59, 1.16.59 · NVD, WPVulnerability
  14. High 8.8

    CVE-2021-24307 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Deserialization of Untrusted Data

    Published 9 May 2021 · Fixed in 4.1.0.2 · WPVulnerability
  15. Medium 4.3

    CVE-2020-29445 · Confluence

    Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters.

    Published 7 May 2021 · Fixed in 7.4.8, 7.11.0 · NVD
  16. Medium 5.4

    CVE-2020-29444 · Confluence

    Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters.

    Published 7 May 2021 · Fixed in 7.11.0 · NVD
  17. Medium 5.3

    CVE-2021-22210 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results.

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  18. High 7.5

    CVE-2021-22209 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed.

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  19. Medium 4.3

    CVE-2021-22208 · GitLab

    An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update.

    Published 6 May 2021 · Fixed in 13.9.7 · NVD
  20. Medium 4.9

    CVE-2021-22206 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  21. Critical 9.8

    CVE-2021-29921 · Python

    In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

    Published 6 May 2021 · Fixed in 3.8.12, 3.9.5 · NVD
  22. Medium 4.3

    CVE-2021-22211 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling.

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  23. Medium 6.5

    CVE-2021-20326 · MongoDB

    A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4.

    Published 30 Apr 2021 · Fixed in 4.4.4 · NVD
  24. Unrated

    WPV-72dac1cfa68d · WooCommerce

    Vulnerability in WooCommerce

    Published 29 Apr 2021 · Fixed in 5.2.0 · WPVulnerability
  25. Medium 6.4

    CVE-2021-31779 · Yoast SEO

    The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.

    Published 28 Apr 2021 · Fixed in 7.2.1 · NVD
  26. Critical 9.8

    CVE-2020-36326 · WordPress

    PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment…

    Published 28 Apr 2021 · Fixed in 5.5.5, 5.6.4, 5.7.2 · NVD
  27. Medium 4.8

    CVE-2021-24427 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 25 Apr 2021 · Fixed in 2.1.3 · WPVulnerability
  28. Critical 10.0Actively exploited

    CVE-2021-22205 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

    Published 23 Apr 2021 · Fixed in 13.8.8, 13.9.6, 13.10.3 · NVD
  29. Low 2.7

    CVE-2021-2308 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 22 Apr 2021 · NVD
  30. Medium 6.1

    CVE-2021-2307 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the…

    Published 22 Apr 2021 · NVD
  31. Medium 4.9

    CVE-2021-2305 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 22 Apr 2021 · NVD
  32. Medium 5.5

    CVE-2021-2304 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  33. Low 2.7

    CVE-2021-2301 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 22 Apr 2021 · NVD
  34. Medium 4.9

    CVE-2021-2300 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 22 Apr 2021 · NVD
  35. Medium 4.9

    CVE-2021-2299 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  36. Medium 6.5

    CVE-2021-2298 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  37. Medium 4.9

    CVE-2021-2293 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  38. Medium 4.9

    CVE-2021-2278 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  39. Low 1.9

    CVE-2021-2232 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.23 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 22 Apr 2021 · NVD
  40. Medium 4.9

    CVE-2021-2230 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  41. Medium 4.9

    CVE-2021-2226 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to…

    Published 22 Apr 2021 · NVD
  42. Medium 4.9

    CVE-2021-2217 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  43. Medium 4.9

    CVE-2021-2215 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  44. Medium 4.9

    CVE-2021-2213 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  45. Medium 4.9

    CVE-2021-2212 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  46. Medium 4.9

    CVE-2021-2208 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  47. Medium 4.9

    CVE-2021-2203 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  48. Medium 6.5

    CVE-2021-2202 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 22 Apr 2021 · NVD
  49. Medium 4.9

    CVE-2021-2201 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  50. Medium 4.9

    CVE-2021-2196 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 22 Apr 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.