Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,243
- Published in 7 days
- 258
- Critical in 30 days
- 70
- Actively exploited
- 62
Latest vulnerabilities
11,243 vulnerabilities- High 8.8
CVE-2020-35625 · MediaWiki
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.
Published 21 Dec 2020 · NVD - Medium 5.3
CVE-2020-35624 · MediaWiki
An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a full vote timestamp, which may provide unintended clues about how a voting process unfolded.
Published 21 Dec 2020 · NVD - High 7.5
CVE-2020-35623 · MediaWiki
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or…
Published 21 Dec 2020 · NVD - Medium 6.1
CVE-2020-35622 · MediaWiki
An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap::makeForeignLink unsafely. The $page variable within the formatItem function was not being properly escaped, allowing for XSS under certain conditions.
Published 21 Dec 2020 · NVD - Medium 5.3
CVE-2020-35480 · MediaWiki
An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 6.1
CVE-2020-35479 · MediaWiki
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 6.1
CVE-2020-35478 · MediaWiki
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 5.3
CVE-2020-35477 · MediaWiki
MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a…
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - High 7.5
CVE-2020-35475 · MediaWiki
In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 6.1
CVE-2020-35474 · MediaWiki
In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Unrated
WPV-a26423547b6b · Contact Form 7
Vulnerability in Contact Form 7
Published 17 Dec 2020 · Fixed in 5.3.2 · WPVulnerability - Critical 10.0
CVE-2020-35489 · Contact Form 7
Contact Form 7: Unrestricted Upload of File with Dangerous Type
Published 17 Dec 2020 · Fixed in 5.3.2 · NVD, WPVulnerability - High 7.5
CVE-2020-8286 · curl
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Published 14 Dec 2020 · Fixed in 7.74.0 · NVD - High 7.5
CVE-2020-8285 · curl
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Published 14 Dec 2020 · Fixed in 7.74.0 · NVD - Low 3.7
CVE-2020-8284 · curl
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Published 14 Dec 2020 · NVD - High 7.5
CVE-2020-8231 · curl
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
Published 14 Dec 2020 · NVD - High 7.8
CVE-2020-8177 · curl
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
Published 14 Dec 2020 · NVD - High 7.5
CVE-2020-8169 · curl
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
Published 14 Dec 2020 · NVD - Medium 4.3
CVE-2020-26411 · GitLab
A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.3
CVE-2020-26417 · GitLab
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.4
CVE-2020-26416 · GitLab
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.3
CVE-2020-26415 · GitLab
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.3
CVE-2020-26413 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.
Published 11 Dec 2020 · Fixed in 13.6.2 · NVD - Medium 4.3
CVE-2020-26412 · GitLab
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.
Published 11 Dec 2020 · Fixed in 13.6.2 · NVD - Medium 5.3
CVE-2020-26408 · GitLab
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker to view limited information in user's private profile
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.3
CVE-2020-13357 · GitLab
An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 6.5
CVE-2020-26409 · GitLab
A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.4
CVE-2020-26407 · GitLab
A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project
Published 10 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.9
CVE-2020-1971 · Node.js, OpenSSL, MySQL
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may…
Published 8 Dec 2020 · Fixed in 12.20.1, 14.15.4, 15.5.0 · NVD - Medium 6.5
CVE-2018-21270 · Node.js
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
Published 3 Dec 2020 · Fixed in 0.0.6 · NVD - High 7.5
CVE-2020-17527 · Apache Tomcat
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that…
Published 3 Dec 2020 · NVD - Medium 6.1
CVE-2020-36171 · Elementor
Elementor Website Builder – more than just a page builder: Cross-site Scripting
Published 25 Nov 2020 · Fixed in 3.0.14 · NVD, WPVulnerability - High 7.5
CVE-2019-20925 · MongoDB
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.
Published 24 Nov 2020 · Fixed in 3.6.15, 4.0.13, 4.2.1 · NVD - Medium 5.4
CVE-2020-29003 · MediaWiki
The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll.
Published 24 Nov 2020 · NVD - Medium 4.8
CVE-2020-29002 · MediaWiki
includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator.
Published 24 Nov 2020 · NVD - High 7.5
CVE-2020-25696 · PostgreSQL
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality…
Published 23 Nov 2020 · Fixed in 11.10, 12.5, 13.1 · NVD - Medium 6.5
CVE-2018-20803 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.
Published 23 Nov 2020 · Fixed in 3.4.19, 3.6.10, 4.0.5 · NVD - Medium 6.5
CVE-2020-7928 · MongoDB
A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20.
Published 23 Nov 2020 · Fixed in 4.2.9, 4.4.1, 4.5.1 · NVD - Medium 6.5
CVE-2019-2393 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13 and MongoDB Server v3.6 versions prior to 3.6.15.
Published 23 Nov 2020 · Fixed in 3.6.15, 4.0.13, 4.2.1 · NVD - Medium 6.5
CVE-2019-2392 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20.
Published 23 Nov 2020 · Fixed in 4.0.20, 4.2.9, 4.4.1 · NVD - Medium 6.5
CVE-2019-20924 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2.
Published 23 Nov 2020 · Fixed in 4.2.2 · NVD - Medium 6.5
CVE-2019-20923 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.
Published 23 Nov 2020 · Fixed in 4.0.7 · NVD - Medium 6.5
CVE-2018-20805 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.
Published 23 Nov 2020 · Fixed in 3.6.10, 4.0.5 · NVD - Medium 6.5
CVE-2018-20804 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.
Published 23 Nov 2020 · Fixed in 3.6.13, 4.0.10 · NVD - Medium 6.5
CVE-2018-20802 · MongoDB
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.
Published 23 Nov 2020 · Fixed in 3.6.9, 4.0.3 · NVD - Medium 6.5
CVE-2020-7926 · MongoDB
A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects MongoDB Server v4.4 versions prior to 4.4.1. Versions before 4.4 are not affected.
Published 23 Nov 2020 · Fixed in 4.4.1 · NVD - High 7.5
CVE-2020-7925 · MongoDB
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.
Published 23 Nov 2020 · Fixed in 4.2.9 · NVD - High 7.5
CVE-2020-8277 · c-ares, Node.js
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
Published 19 Nov 2020 · Fixed in 12.19.1, 14.15.1, 15.2.1 · NVD - High 7.6
CVE-2020-13359 · GitLab
The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
Published 19 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD - High 8.2
CVE-2020-13356 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: >=8.8.9, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
Published 19 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.