UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,229
Published in 7 days
248
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,229 vulnerabilities
  1. Medium 4.9

    CVE-2021-2194 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 22 Apr 2021 · Fixed in 10.3.26, 10.4.16, 10.5.7 · NVD
  2. Medium 4.9

    CVE-2021-2193 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  3. Medium 4.9

    CVE-2021-2180 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 22 Apr 2021 · Fixed in 10.2.38 · NVD
  4. Medium 4.9

    CVE-2021-2179 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 22 Apr 2021 · NVD
  5. Medium 6.5

    CVE-2021-2178 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 22 Apr 2021 · NVD
  6. Medium 4.4

    CVE-2021-2174 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 22 Apr 2021 · Fixed in 10.2.18 · NVD
  7. Medium 6.5

    CVE-2021-2172 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 22 Apr 2021 · NVD
  8. Medium 4.4

    CVE-2021-2171 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 22 Apr 2021 · NVD
  9. Medium 4.9

    CVE-2021-2170 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  10. Medium 4.9

    CVE-2021-2169 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 22 Apr 2021 · NVD
  11. Medium 4.9

    CVE-2021-2166 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 22 Apr 2021 · Fixed in 10.3.29, 10.4.19, 10.5.10 · NVD
  12. Medium 4.9

    CVE-2021-2164 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 22 Apr 2021 · NVD
  13. Medium 5.3

    CVE-2021-2163 · Java

    Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via…

    Published 22 Apr 2021 · NVD
  14. Medium 4.3

    CVE-2021-2162 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plug-in). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or…

    Published 22 Apr 2021 · NVD
  15. Medium 5.9

    CVE-2021-2161 · Java

    Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via…

    Published 22 Apr 2021 · NVD
  16. Medium 4.9

    CVE-2021-2160 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 22 Apr 2021 · NVD
  17. Medium 4.9

    CVE-2021-2154 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 22 Apr 2021 · Fixed in 10.3.29, 10.4.19, 10.5.10 · NVD
  18. Medium 4.9

    CVE-2021-2146 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 22 Apr 2021 · NVD
  19. High 7.2

    CVE-2021-2144 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base…

    Published 22 Apr 2021 · Fixed in 10.2.28, 10.3.19, 10.4.9 · NVD
  20. Medium 5.4

    CVE-2021-22199 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used.

    Published 22 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  21. High 7.5

    CVE-2021-31555 · MediaWiki

    An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version) parameter's length.

    Published 22 Apr 2021 · NVD
  22. Medium 5.4

    CVE-2021-31554 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created MediaWiki user accounts, thus allowing nefarious users to remain unblocked.

    Published 22 Apr 2021 · NVD
  23. Medium 6.5

    CVE-2021-31553 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such that denial of service occurred for certain CheckUser extension pages and functionality. For example, the attacker could turn off Special:CheckUserLog and thus interfere with usage tracking.

    Published 22 Apr 2021 · NVD
  24. Medium 5.4

    CVE-2021-31552 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account (and not the user account itself). Such rules could also be used by a nefarious, unprivileged user to…

    Published 22 Apr 2021 · NVD
  25. Medium 6.1

    CVE-2021-31551 · MediaWiki

    An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.

    Published 22 Apr 2021 · NVD
  26. Medium 5.4

    CVE-2021-31550 · MediaWiki

    An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.

    Published 22 Apr 2021 · NVD
  27. Medium 4.3

    CVE-2021-31549 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users.

    Published 22 Apr 2021 · NVD
  28. Medium 6.5

    CVE-2021-31548 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.

    Published 22 Apr 2021 · NVD
  29. Medium 4.3

    CVE-2021-31547 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.

    Published 22 Apr 2021 · NVD
  30. Medium 4.3

    CVE-2021-31546 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have been visible to users with access to view AbuseFilter log data.

    Published 22 Apr 2021 · NVD
  31. Medium 5.3

    CVE-2021-31545 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWiki usernames, related to rev_deleted.

    Published 22 Apr 2021 · NVD
  32. High 7.5

    CVE-2021-28965 · Ruby

    The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

    Published 21 Apr 2021 · Fixed in 2.6.7, 2.7.3, 3.0.1 · NVD
  33. Medium 4.8

    CVE-2021-24323 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 21 Apr 2021 · Fixed in 5.2.0 · NVD, WPVulnerability
  34. Medium 6.5

    CVE-2021-29447 · WordPress

    WordPress: Authenticated XXE attack when installation is running PHP 8

    Published 15 Apr 2021 · Fixed in 5.7.1 · NVD, WordPress
  35. Medium 4.3

    CVE-2021-29450 · WordPress

    WordPress: Authenticated disclosure of password-protected posts and pages

    Published 15 Apr 2021 · Fixed in 5.7.1 · NVD, WordPress
  36. Medium 5.3

    CVE-2021-26031 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.

    Published 14 Apr 2021 · NVD
  37. Medium 6.1

    CVE-2021-26030 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page

    Published 14 Apr 2021 · NVD
  38. Critical 9.8

    CVE-2021-31162 · Rust

    In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.

    Published 14 Apr 2021 · Fixed in 1.52.0 · NVD
  39. High 8.2

    CVE-2020-36323 · Rust

    In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

    Published 14 Apr 2021 · Fixed in 1.52.0 · NVD
  40. Medium 5.9

    CVE-2018-25008 · Rust

    In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions.

    Published 14 Apr 2021 · Fixed in 1.29.0 · NVD
  41. Medium 5.9

    CVE-2017-20004 · Rust

    In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any types, allowing for memory safety issues through race conditions.

    Published 14 Apr 2021 · Fixed in 1.19.0 · NVD
  42. Unrated

    WPV-f45c2bbf84cc · Woolentor Addons (WordPress plugin)

    Vulnerability in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

    Published 13 Apr 2021 · Fixed in 1.8.6 · WPVulnerability
  43. Medium 5.4

    CVE-2021-24262 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 13 Apr 2021 · Fixed in 1.8.6 · WPVulnerability
  44. Medium 6.5

    CVE-2021-22190 · GitLab

    A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token

    Published 12 Apr 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  45. Medium 5.4

    CVE-2021-24329 · WP Super Cache (WordPress plugin)

    WP Super Cache: Cross-site Scripting

    Published 12 Apr 2021 · Fixed in 1.7.3 · WPVulnerability
  46. Critical 9.8

    CVE-2021-28879 · Rust

    In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.

    Published 11 Apr 2021 · Fixed in 1.52.0 · NVD
  47. High 7.5

    CVE-2021-28878 · Rust

    In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    Published 11 Apr 2021 · Fixed in 1.52.0 · NVD
  48. High 7.5

    CVE-2021-28877 · Rust

    In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    Published 11 Apr 2021 · Fixed in 1.51.0 · NVD
  49. Medium 5.3

    CVE-2021-28876 · Rust

    In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    Published 11 Apr 2021 · Fixed in 1.52.0 · NVD
  50. High 7.5

    CVE-2021-28875 · Rust

    In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.

    Published 11 Apr 2021 · Fixed in 1.50.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.