UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,229
Published in 7 days
244
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,229 vulnerabilities
  1. Critical 9.8

    CVE-2020-36318 · Rust

    In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.

    Published 11 Apr 2021 · Fixed in 1.49.0 · NVD
  2. High 7.5

    CVE-2020-36317 · Rust

    In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.

    Published 11 Apr 2021 · Fixed in 1.49.0 · NVD
  3. High 7.5

    CVE-2015-20001 · Rust

    In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation.

    Published 11 Apr 2021 · Fixed in 1.2.0 · NVD
  4. High 7.0

    CVE-2021-29221 · Erlang/OTP

    A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe…

    Published 9 Apr 2021 · Fixed in 23.2.3 · NVD
  5. Medium 4.3

    CVE-2021-30159 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if…

    Published 9 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  6. Medium 4.3

    CVE-2021-30156 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists.

    Published 9 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  7. Medium 4.3

    CVE-2021-30155 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.

    Published 9 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  8. Medium 4.3

    CVE-2021-30152 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.

    Published 9 Apr 2021 · Fixed in 1.31.13, 1.35.2 · NVD
  9. High 8.8

    CVE-2021-26758 · OpenLiteSpeed

    Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.

    Published 7 Apr 2021 · NVD
  10. Medium 5.3

    CVE-2021-30158 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party.

    Published 6 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  11. Medium 6.1

    CVE-2021-30157 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.

    Published 6 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  12. Medium 6.1

    CVE-2021-30154 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.

    Published 6 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  13. High 8.8

    CVE-2021-24159 · Contact Form 7

    Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully…

    Published 5 Apr 2021 · NVD
  14. Critical 9.8

    CVE-2021-22203 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5 · NVD
  15. Medium 4.3

    CVE-2021-22202 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.

    Published 2 Apr 2021 · NVD
  16. Medium 6.5

    CVE-2021-22201 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.

    Published 2 Apr 2021 · Fixed in 13.9.5, 13.10.1 · NVD
  17. High 7.5

    CVE-2021-22200 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5 · NVD
  18. Medium 4.3

    CVE-2021-22198 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  19. Medium 4.3

    CVE-2021-22197 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  20. Medium 5.4

    CVE-2021-22196 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  21. Medium 4.3

    CVE-2021-26072 · Confluence

    The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

    Published 1 Apr 2021 · Fixed in 5.8.6 · NVD
  22. Low 3.7

    CVE-2021-22890 · curl

    curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a…

    Published 1 Apr 2021 · NVD
  23. Medium 5.3

    CVE-2021-22876 · curl

    curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the…

    Published 1 Apr 2021 · NVD
  24. Medium 4.3

    CVE-2021-22177 · GitLab

    Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.

    Published 1 Apr 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  25. Medium 4.3

    CVE-2021-3393 · PostgreSQL

    An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but…

    Published 1 Apr 2021 · Fixed in 11.11, 12.6, 13.2 · NVD
  26. Medium 4.4

    CVE-2021-22194 · GitLab

    In all versions of GitLab, marshalled session keys were being stored in Redis.

    Published 26 Mar 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  27. Medium 5.5

    CVE-2021-22184 · GitLab

    An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted.

    Published 26 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  28. Medium 4.3

    CVE-2021-22180 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.

    Published 26 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  29. Medium 4.3

    CVE-2021-22172 · GitLab

    Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page

    Published 26 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  30. High 7.4

    CVE-2021-3450 · Node.js, OpenSSL, MySQL

    The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a…

    Published 25 Mar 2021 · Fixed in 12.22.1, 14.16.1, 15.14.0 · NVD
  31. Medium 5.9

    CVE-2021-3449 · Node.js, OpenSSL, MySQL

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server…

    Published 25 Mar 2021 · Fixed in 12.22.1, 14.16.1, 15.14.0 · NVD
  32. Medium 4.3

    CVE-2021-22169 · GitLab

    An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.

    Published 24 Mar 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  33. Low 3.5

    CVE-2021-22193 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.

    Published 24 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  34. High 8.8

    CVE-2021-22192 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.

    Published 24 Mar 2021 · Fixed in 13.7.9, 13.8.6, 13.9.4 · NVD
  35. Medium 4.9

    CVE-2021-22186 · GitLab

    An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners

    Published 24 Mar 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  36. Medium 5.4

    CVE-2021-22185 · GitLab

    Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki

    Published 24 Mar 2021 · Fixed in 13.8.5, 13.9.2 · NVD
  37. Medium 5.4

    CVE-2021-22179 · GitLab

    A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.

    Published 24 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  38. Medium 5.0

    CVE-2021-22178 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.

    Published 24 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  39. Medium 4.3

    CVE-2021-22176 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

    Published 24 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  40. Critical 9.1

    CVE-2021-21351 · MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · NVD
  41. High 7.5

    CVE-2021-21348 · MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on…

    Published 23 Mar 2021 · NVD
  42. Critical 9.8

    CVE-2021-21344 · MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · NVD
  43. Medium 6.1

    CVE-2021-24891 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 23 Mar 2021 · Fixed in 3.1.4, 3.4.8, 3.6.3 · NVD, WPVulnerability
  44. High 7.8

    CVE-2019-10128 · PostgreSQL

    A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read…

    Published 19 Mar 2021 · Fixed in 9.6.13, 10.8, 11.3 · NVD
  45. High 8.8

    CVE-2019-10127 · PostgreSQL

    A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL…

    Published 19 Mar 2021 · Fixed in 9.6.13, 10.8, 11.3 · NVD
  46. High 7.2

    CVE-2021-27928 · MariaDB

    A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this…

    Published 19 Mar 2021 · Fixed in 10.3.28, 10.4.18, 10.5.9 · NVD
  47. Unrated

    WPV-c9c9e938ba16 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 17 Mar 2021 · Fixed in 3.1.4 · WPVulnerability
  48. Medium 5.4

    CVE-2021-24206 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  49. Medium 5.4

    CVE-2021-24205 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  50. Medium 5.4

    CVE-2021-24204 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.