UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,229
Published in 7 days
244
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,229 vulnerabilities
  1. Medium 5.4

    CVE-2021-24203 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  2. Medium 5.4

    CVE-2021-24202 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  3. Medium 5.4

    CVE-2021-24201 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  4. High 7.2

    CVE-2021-24209 · WP Super Cache (WordPress plugin)

    WP Super Cache: Code Injection

    Published 16 Mar 2021 · Fixed in 1.7.2 · WPVulnerability
  5. Medium 4.3

    CVE-2021-22134 · Elasticsearch

    A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of…

    Published 8 Mar 2021 · NVD
  6. High 7.1

    CVE-2021-28041 · OpenSSH

    ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

    Published 5 Mar 2021 · Fixed in 8.5 · NVD
  7. Medium 5.3

    CVE-2021-26029 · Joomla!

    An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  8. Medium 5.5

    CVE-2021-26028 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  9. Medium 5.3

    CVE-2021-26027 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  10. High 7.5

    CVE-2021-23132 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  11. High 7.5

    CVE-2021-23131 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  12. Medium 6.1

    CVE-2021-23130 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  13. Medium 6.1

    CVE-2021-23129 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  14. Critical 9.1

    CVE-2021-23128 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  15. Critical 9.1

    CVE-2021-23127 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  16. Medium 5.3

    CVE-2021-23126 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  17. High 7.2

    CVE-2021-22189 · GitLab

    Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.

    Published 4 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  18. Medium 5.4

    CVE-2021-22183 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.

    Published 4 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  19. High 7.5

    CVE-2021-22884 · Node.js

    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the…

    Published 3 Mar 2021 · Fixed in 12.21.0, 14.16.0, 15.10.0 · NVD
  20. High 7.5

    CVE-2021-22883 · Node.js

    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file…

    Published 3 Mar 2021 · Fixed in 12.21.0, 14.16.0, 15.10.0 · NVD
  21. Medium 4.8

    CVE-2021-22878 · Nextcloud

    Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

    Published 3 Mar 2021 · Fixed in 20.0.6 · NVD
  22. Medium 6.5

    CVE-2021-22877 · Nextcloud

    A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet.

    Published 3 Mar 2021 · Fixed in 20.0.6 · NVD
  23. Medium 5.3

    CVE-2021-22188 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs.

    Published 3 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  24. Medium 5.4

    CVE-2021-22182 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.

    Published 3 Mar 2021 · Fixed in 13.7.6, 13.8.2 · NVD
  25. Medium 6.7

    CVE-2020-8296 · Nextcloud

    Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.

    Published 3 Mar 2021 · Fixed in 20.0.0 · NVD
  26. Medium 4.3

    CVE-2021-22187 · GitLab

    An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.

    Published 2 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  27. Medium 4.9

    CVE-2018-25004 · MongoDB

    A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

    Published 1 Mar 2021 · Fixed in 3.6.11, 4.0.6 · NVD
  28. Medium 6.5

    CVE-2020-7929 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.

    Published 1 Mar 2021 · Fixed in 3.6.21, 4.0.20 · NVD
  29. High 7.0

    CVE-2021-25329 · Apache Tomcat

    The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for…

    Published 1 Mar 2021 · NVD
  30. High 7.5

    CVE-2021-25122 · Apache Tomcat

    When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

    Published 1 Mar 2021 · NVD
  31. High 8.1

    CVE-2021-26701 · .NET

    .NET Core Remote Code Execution Vulnerability

    Published 25 Feb 2021 · Fixed in 5.0.4 · NVD
  32. High 8.1

    CVE-2021-24112 · .NET

    .NET Core Remote Code Execution Vulnerability

    Published 25 Feb 2021 · NVD
  33. Medium 6.5

    CVE-2021-1721 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 25 Feb 2021 · NVD
  34. Medium 4.3

    CVE-2021-20229 · PostgreSQL

    A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

    Published 23 Feb 2021 · Fixed in 13.2 · NVD
  35. Medium 5.3

    CVE-2020-29448 · Confluence

    The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

    Published 22 Feb 2021 · Fixed in 6.13.18, 7.4.6, 7.8.3 · NVD
  36. Medium 5.9

    CVE-2021-23841 · OpenSSL, MySQL

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref…

    Published 16 Feb 2021 · Fixed in 1.1.1j, 5.7.33, 8.0.23 · NVD
  37. High 7.5

    CVE-2021-23840 · Node.js, OpenSSL, MySQL

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave…

    Published 16 Feb 2021 · Fixed in 10.24.0, 12.21.0, 15.10.0 · NVD
  38. Low 3.7

    CVE-2021-23839 · OpenSSL

    OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is…

    Published 16 Feb 2021 · NVD
  39. Medium 5.9

    CVE-2021-23336 · Python

    The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation…

    Published 15 Feb 2021 · Fixed in 3.7.10, 3.8.8, 3.9.2 · NVD
  40. High 7.5

    CVE-2021-21702 · PHP

    In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

    Published 15 Feb 2021 · Fixed in 7.3.27, 7.4.15, 8.0.2 · NVD
  41. Medium 5.3

    CVE-2020-7071 · PHP

    In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.

    Published 15 Feb 2021 · Fixed in 7.3.26, 7.4.14, 8.0.1 · NVD
  42. Critical 9.1

    CVE-2021-21014 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  43. Medium 5.6

    CVE-2021-21032 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  44. Medium 5.6

    CVE-2021-21031 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  45. High 8.1

    CVE-2021-21030 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  46. Medium 4.8

    CVE-2021-21029 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  47. Medium 4.3

    CVE-2021-21027 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  48. Medium 5.3

    CVE-2021-21026 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  49. Critical 9.1

    CVE-2021-21025 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD
  50. Critical 9.1

    CVE-2021-21024 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.