Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,232
- Published in 7 days
- 247
- Critical in 30 days
- 70
- Actively exploited
- 62
Latest vulnerabilities
11,232 vulnerabilities- Medium 4.9
CVE-2021-2009 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 20 Jan 2021 · NVD - Low 3.7
CVE-2021-2007 · MariaDB, MySQL
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a…
Published 20 Jan 2021 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD - Medium 5.3
CVE-2021-2006 · MySQL
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…
Published 20 Jan 2021 · NVD - Medium 4.9
CVE-2021-2002 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 20 Jan 2021 · NVD - Medium 4.9
CVE-2021-2001 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.50 and prior, 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…
Published 20 Jan 2021 · NVD - Low 3.8
CVE-2021-1998 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of…
Published 20 Jan 2021 · NVD - Medium 6.1
CVE-2021-24241 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)
Advanced Custom Field Pro: Cross-site Scripting
Published 20 Jan 2021 · Fixed in 5.9.1 · NVD, WPVulnerability - Critical 9.8
CVE-2021-3177 · Python
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
Published 19 Jan 2021 · NVD - Medium 6.5
CVE-2020-29450 · Confluence
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0.
Published 19 Jan 2021 · Fixed in 7.2.0 · NVD - High 7.8
CVE-2021-3162 · Docker Engine
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
Published 15 Jan 2021 · Fixed in 2.5.0.0 · NVD - Medium 6.5
CVE-2021-22171 · GitLab
Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - Medium 6.5
CVE-2021-22168 · GitLab
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - High 7.5
CVE-2021-22167 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - High 7.5
CVE-2021-22166 · GitLab
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method
Published 15 Jan 2021 · Fixed in 13.7.2 · NVD - Medium 6.5
CVE-2020-26414 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string.
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - High 7.5
CVE-2020-35733 · Erlang/OTP
An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.
Published 15 Jan 2021 · Fixed in 23.2.2 · NVD - Medium 4.8
CVE-2021-22132 · Elasticsearch
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Published 14 Jan 2021 · Fixed in 7.10.2 · NVD - Medium 5.9
CVE-2021-24122 · Apache Tomcat
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the…
Published 14 Jan 2021 · NVD - High 7.5
CVE-2021-3138 · Discourse
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.
Published 14 Jan 2021 · NVD - High 8.1
CVE-2021-21013 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.
Published 13 Jan 2021 · NVD - Medium 5.3
CVE-2021-21012 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.
Published 13 Jan 2021 · NVD - Medium 6.1
CVE-2021-23125 · Joomla!
An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.
Published 12 Jan 2021 · NVD - Medium 6.1
CVE-2021-23124 · Joomla!
An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.
Published 12 Jan 2021 · NVD - Medium 5.3
CVE-2021-23123 · Joomla!
An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules.
Published 12 Jan 2021 · NVD - High 7.5
CVE-2021-1723 · .NET
ASP.NET Core and Visual Studio Denial of Service Vulnerability
Published 12 Jan 2021 · NVD - Medium 6.5
CVE-2020-8287 · Node.js
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
Published 6 Jan 2021 · Fixed in 12.20.1, 14.15.4, 15.5.1 · NVD - High 8.1
CVE-2020-8265 · Node.js
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult…
Published 6 Jan 2021 · Fixed in 12.20.1, 14.15.4, 15.5.1 · NVD - Medium 5.3
CVE-2020-27534 · Docker Engine
util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.
Published 30 Dec 2020 · Fixed in 19.03.9 · NVD - High 7.5
CVE-2020-35616 · Joomla!
An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations.
Published 28 Dec 2020 · NVD - Medium 6.3
CVE-2020-35615 · Joomla!
An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability.
Published 28 Dec 2020 · NVD - Medium 5.3
CVE-2020-35614 · Joomla!
An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page.
Published 28 Dec 2020 · NVD - Critical 9.8
CVE-2020-35613 · Joomla!
An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list.
Published 28 Dec 2020 · NVD - High 7.5
CVE-2020-35612 · Joomla!
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerability.
Published 28 Dec 2020 · NVD - High 7.5
CVE-2020-35611 · Joomla!
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.
Published 28 Dec 2020 · NVD - High 7.5
CVE-2020-35610 · Joomla!
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms.
Published 28 Dec 2020 · NVD - Unrated
WPV-462a6eeaf9ea · LiteSpeed Cache
Vulnerability in LiteSpeed Cache
Published 26 Dec 2020 · Fixed in 3.6.1 · WPVulnerability - Medium 6.1
CVE-2020-29172 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 26 Dec 2020 · Fixed in 3.6.1 · NVD, WPVulnerability - High 7.0
CVE-2020-28912 · MariaDB
With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between the client and the server, and getting the ability to run SQL commands on behalf of the connected…
Published 24 Dec 2020 · Fixed in 10.3.26, 10.4.16, 10.5.7 · NVD - High 8.8
CVE-2020-35626 · MediaWiki
An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was completely vulnerable to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.
Published 21 Dec 2020 · NVD - High 8.8
CVE-2020-35625 · MediaWiki
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.
Published 21 Dec 2020 · NVD - Medium 5.3
CVE-2020-35624 · MediaWiki
An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a full vote timestamp, which may provide unintended clues about how a voting process unfolded.
Published 21 Dec 2020 · NVD - High 7.5
CVE-2020-35623 · MediaWiki
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or…
Published 21 Dec 2020 · NVD - Medium 6.1
CVE-2020-35622 · MediaWiki
An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap::makeForeignLink unsafely. The $page variable within the formatItem function was not being properly escaped, allowing for XSS under certain conditions.
Published 21 Dec 2020 · NVD - Medium 5.3
CVE-2020-35480 · MediaWiki
An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 6.1
CVE-2020-35479 · MediaWiki
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 6.1
CVE-2020-35478 · MediaWiki
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 5.3
CVE-2020-35477 · MediaWiki
MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a…
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - High 7.5
CVE-2020-35475 · MediaWiki
In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 6.1
CVE-2020-35474 · MediaWiki
In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Unrated
WPV-a26423547b6b · Contact Form 7
Vulnerability in Contact Form 7
Published 17 Dec 2020 · Fixed in 5.3.2 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.