UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,254
Published in 7 days
269
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,254 vulnerabilities
  1. Low 3.7

    CVE-2020-14779 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability…

    Published 21 Oct 2020 · NVD
  2. Medium 4.9

    CVE-2020-14777 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  3. Medium 4.9

    CVE-2020-14776 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2020 · Fixed in 10.3.26, 10.4.16, 10.5.7 · NVD
  4. Medium 6.5

    CVE-2020-14775 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2020 · NVD
  5. Medium 4.9

    CVE-2020-14773 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  6. Low 2.2

    CVE-2020-14771 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 21 Oct 2020 · NVD
  7. Medium 6.5

    CVE-2020-14769 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 21 Oct 2020 · NVD
  8. Medium 6.5

    CVE-2020-14765 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 21 Oct 2020 · Fixed in 10.3.26, 10.4.16, 10.5.7 · NVD
  9. Medium 5.5

    CVE-2020-14760 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD
  10. Medium 4.9

    CVE-2020-14672 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 21 Oct 2020 · Fixed in 8.0.21 · NVD
  11. Medium 6.1

    CVE-2020-24408 · Magento / Adobe Commerce

    Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.

    Published 16 Oct 2020 · NVD
  12. Medium 4.3

    CVE-2020-13943 · Apache Tomcat

    If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the…

    Published 12 Oct 2020 · NVD
  13. Medium 4.9

    CVE-2020-13341 · GitLab

    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions.

    Published 12 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  14. Medium 4.7

    CVE-2020-15242 · Next.js

    Open Redirect in Next.js versions

    Published 8 Oct 2020 · Fixed in 9.5.4 · OSV.dev and GitHub
  15. Medium 4.4

    CVE-2020-13344 · GitLab

    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis

    Published 8 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  16. High 8.7

    CVE-2020-13340 · GitLab

    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

    Published 8 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  17. Medium 6.5

    CVE-2020-13339 · GitLab

    An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted.

    Published 8 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  18. Low 2.7

    CVE-2020-13342 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  19. Critical 9.1

    CVE-2020-13347 · GitLab

    A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.

    Published 7 Oct 2020 · Fixed in 13.2.4, 13.3.2, 13.4.1 · NVD
  20. Medium 6.5

    CVE-2020-13346 · GitLab

    Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  21. Medium 4.3

    CVE-2020-13335 · GitLab

    Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  22. High 7.5

    CVE-2020-13334 · GitLab

    In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  23. Medium 5.4

    CVE-2020-13345 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes

    Published 6 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  24. High 8.8

    CVE-2020-13343 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template

    Published 6 Oct 2020 · NVD
  25. Medium 4.3

    CVE-2020-13333 · GitLab

    A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.

    Published 6 Oct 2020 · NVD
  26. High 7.5

    CVE-2020-25613 · Ruby

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

    Published 6 Oct 2020 · NVD
  27. Medium 6.5

    CVE-2020-8223 · Nextcloud

    A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves.

    Published 5 Oct 2020 · NVD
  28. Medium 5.4

    CVE-2020-13338 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references.

    Published 2 Oct 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  29. Medium 4.8

    CVE-2020-13337 · GitLab

    An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name.

    Published 2 Oct 2020 · Fixed in 12.10.12 · NVD
  30. Medium 5.3

    CVE-2020-7070 · PHP

    In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

    Published 2 Oct 2020 · Fixed in 7.2.34, 7.3.23, 7.4.11 · NVD
  31. Medium 6.5

    CVE-2020-7069 · PHP

    In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

    Published 2 Oct 2020 · Fixed in 7.2.34, 7.3.23, 7.4.11 · NVD
  32. High 7.5

    CVE-2020-25623 · Erlang/OTP

    Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used.

    Published 2 Oct 2020 · Fixed in 22.3.4.6, 23.1 · NVD
  33. Medium 4.8

    CVE-2020-13336 · GitLab

    An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  34. Medium 5.4

    CVE-2020-13331 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  35. Medium 5.4

    CVE-2020-13330 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  36. Medium 6.5

    CVE-2020-13329 · GitLab

    An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature.

    Published 30 Sept 2020 · Fixed in 12.6.2, 12.10.13 · NVD
  37. Medium 4.8

    CVE-2020-13328 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files API.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  38. Medium 4.3

    CVE-2020-13326 · GitLab

    A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github project import could be bypassed.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  39. High 7.1

    CVE-2020-13325 · GitLab

    A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  40. Medium 6.5

    CVE-2020-13324 · GitLab

    A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  41. High 7.7

    CVE-2020-13323 · GitLab

    A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  42. High 7.2

    CVE-2020-13322 · GitLab

    A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy tokens.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  43. High 8.3

    CVE-2020-13321 · GitLab

    A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  44. Medium 6.5

    CVE-2020-13320 · GitLab

    An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  45. Medium 4.3

    CVE-2020-13319 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  46. High 8.8

    CVE-2020-13296 · GitLab

    An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens

    Published 30 Sept 2020 · Fixed in 13.0.14, 13.1.8, 13.2.6 · NVD
  47. High 7.5

    CVE-2020-26121 · MediaWiki

    An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an upload restriction and a create restriction. An attacker cannot leverage this to overwrite anything, but can…

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  48. Medium 6.1

    CVE-2020-26120 · MediaWiki

    XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  49. High 7.5

    CVE-2020-25869 · MediaWiki

    An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  50. Medium 6.1

    CVE-2020-25828 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all…

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.