UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,243
Published in 7 days
258
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,243 vulnerabilities
  1. High 8.1

    CVE-2020-13355 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 19 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  2. High 7.1

    CVE-2020-26405 · GitLab

    Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  3. Medium 4.3

    CVE-2020-13349 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  4. Medium 5.7

    CVE-2020-13348 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. Affected versions are >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  5. Medium 6.5

    CVE-2020-13351 · GitLab

    Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  6. Medium 4.3

    CVE-2020-13350 · GitLab

    CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  7. Medium 5.3

    CVE-2020-26406 · GitLab

    Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  8. Medium 5.5

    CVE-2020-13358 · GitLab

    A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: >=13.4, <13.4.5,>=13.3, <13.3.9,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  9. Medium 4.3

    CVE-2020-13354 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6, <13.3.9.

    Published 17 Nov 2020 · Fixed in 13.3.9 · NVD
  10. Medium 5.3

    CVE-2020-13352 · GitLab

    Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  11. High 8.1

    CVE-2020-8259 · Nextcloud

    Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.

    Published 16 Nov 2020 · Fixed in 20.0.0 · NVD
  12. Medium 4.4

    CVE-2020-8152 · Nextcloud

    Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.

    Published 16 Nov 2020 · Fixed in 20.0.0 · NVD
  13. High 8.8

    CVE-2020-25695 · PostgreSQL

    A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

    Published 16 Nov 2020 · Fixed in 11.10, 12.5, 13.1 · NVD
  14. High 8.1

    CVE-2020-25694 · PostgreSQL

    A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist.…

    Published 16 Nov 2020 · Fixed in 11.10, 12.5, 13.1 · NVD
  15. Medium 4.1

    CVE-2020-8150 · Nextcloud

    A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.

    Published 9 Nov 2020 · Fixed in 19.0.2 · NVD
  16. Medium 5.3

    CVE-2020-8133 · Nextcloud

    A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file.

    Published 9 Nov 2020 · NVD
  17. Critical 9.1

    CVE-2020-24407 · Magento / Adobe Commerce

    Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

    Published 9 Nov 2020 · Fixed in 2.3.5 · NVD
  18. Low 3.7

    CVE-2020-24406 · Magento / Adobe Commerce

    When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.

    Published 9 Nov 2020 · NVD
  19. Medium 4.3

    CVE-2020-24405 · Magento / Adobe Commerce

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.

    Published 9 Nov 2020 · Fixed in 2.3.5 · NVD
  20. Low 2.7

    CVE-2020-24404 · Magento / Adobe Commerce

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

    Published 9 Nov 2020 · Fixed in 2.3.5 · NVD
  21. Low 2.7

    CVE-2020-24403 · Magento / Adobe Commerce

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.

    Published 9 Nov 2020 · Fixed in 2.3.5 · NVD
  22. Medium 4.9

    CVE-2020-24402 · Magento / Adobe Commerce

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.

    Published 9 Nov 2020 · Fixed in 2.3.5 · NVD
  23. Medium 6.5

    CVE-2020-24401 · Magento / Adobe Commerce

    Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.

    Published 9 Nov 2020 · Fixed in 2.3.5 · NVD
  24. High 7.1

    CVE-2020-24400 · Magento / Adobe Commerce

    Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.

    Published 9 Nov 2020 · Fixed in 2.3.5 · NVD
  25. High 7.5

    CVE-2020-28196 · MySQL

    MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

    Published 6 Nov 2020 · NVD
  26. Unrated

    WPV-2f6dda7b6eb2 · WooCommerce

    Vulnerability in WooCommerce

    Published 6 Nov 2020 · Fixed in 4.6.2 · WPVulnerability
  27. Unrated

    WPV-ef33e4c48593 · WooCommerce

    Vulnerability in WooCommerce

    Published 5 Nov 2020 · Fixed in 4.6.2 · WPVulnerability
  28. Medium 6.8

    CVE-2020-8236 · Nextcloud

    A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.

    Published 2 Nov 2020 · Fixed in 19.0.2 · NVD
  29. High 7.5

    CVE-2020-8183 · Nextcloud

    A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.

    Published 2 Nov 2020 · Fixed in 18.0.6, 19.0.1 · NVD
  30. Low 2.2

    CVE-2020-8173 · Nextcloud

    A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.

    Published 2 Nov 2020 · Fixed in 17.0.7, 18.0.5 · NVD
  31. Medium 4.3

    CVE-2020-28040 · WordPress

    WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  32. Critical 9.1

    CVE-2020-28039 · WordPress

    is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  33. Medium 6.1

    CVE-2020-28038 · WordPress

    WordPress before 5.5.2 allows stored XSS via post slugs.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  34. Critical 9.8

    CVE-2020-28037 · WordPress

    is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  35. Critical 9.8

    CVE-2020-28036 · WordPress

    wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  36. Critical 9.8

    CVE-2020-28035 · WordPress

    WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  37. Medium 6.1

    CVE-2020-28034 · WordPress

    WordPress before 5.5.2 allows XSS associated with global variables.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  38. High 7.5

    CVE-2020-28033 · WordPress

    WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  39. Critical 9.8

    CVE-2020-28032 · WordPress

    WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  40. Medium 5.4

    CVE-2020-27957 · MediaWiki

    The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.

    Published 28 Oct 2020 · NVD
  41. Low 3.1

    CVE-2020-7020 · Elasticsearch

    Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional…

    Published 22 Oct 2020 · Fixed in 6.8.13, 7.9.2 · NVD
  42. Medium 4.3

    CVE-2020-27621 · MediaWiki

    The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.

    Published 22 Oct 2020 · NVD
  43. Critical 9.8

    CVE-2020-27619 · Python

    In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

    Published 22 Oct 2020 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD
  44. Medium 4.9

    CVE-2020-14893 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  45. Medium 4.9

    CVE-2020-14891 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  46. Medium 4.9

    CVE-2020-14888 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  47. High 8.0

    CVE-2020-14878 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability…

    Published 21 Oct 2020 · NVD
  48. Medium 4.4

    CVE-2020-14873 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  49. Medium 4.9

    CVE-2020-14870 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  50. Medium 4.9

    CVE-2020-14869 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 21 Oct 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.