UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,262
Published in 7 days
277
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,262 vulnerabilities
  1. Medium 6.1

    CVE-2020-24599 · Joomla!

    An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.

    Published 26 Aug 2020 · Fixed in 3.9.21 · NVD
  2. Medium 6.1

    CVE-2020-24598 · Joomla!

    An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.

    Published 26 Aug 2020 · Fixed in 3.9.21 · NVD
  3. High 7.3

    CVE-2020-14350 · PostgreSQL

    It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

    Published 24 Aug 2020 · Fixed in 10.14, 11.9, 12.4 · NVD
  4. High 7.1

    CVE-2020-14349 · PostgreSQL

    It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

    Published 24 Aug 2020 · Fixed in 10.14, 11.9, 12.4 · NVD
  5. Medium 6.5

    CVE-2020-7923 · MongoDB

    A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.

    Published 21 Aug 2020 · Fixed in 4.0.19, 4.2.8, 4.4.0 · NVD
  6. High 8.0

    CVE-2020-15151 · Magento / Adobe Commerce

    OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

    Published 20 Aug 2020 · NVD
  7. Unrated

    WPV-7519b65d2cbf · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 20 Aug 2020 · Fixed in 2.1.0 · WPVulnerability
  8. Medium 6.3

    CVE-2020-36834 · Woo Discount Rules (WordPress plugin)

    Discount Rules for WooCommerce: Missing Authorization

    Published 20 Aug 2020 · Fixed in 2.1.0 · WPVulnerability
  9. Medium 6.5

    CVE-2020-7019 · Elasticsearch

    In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.

    Published 18 Aug 2020 · Fixed in 6.8.12, 7.9.0 · NVD
  10. High 7.5

    CVE-2020-1597 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests…

    Published 17 Aug 2020 · NVD
  11. Medium 4.3

    CVE-2020-13286 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  12. Medium 6.5

    CVE-2020-13281 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  13. Medium 5.4

    CVE-2020-13285 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  14. Medium 5.4

    CVE-2020-13283 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  15. Low 3.5

    CVE-2020-13282 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  16. Medium 6.5

    CVE-2020-13280 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  17. High 8.1

    CVE-2020-13291 · GitLab

    In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.

    Published 12 Aug 2020 · Fixed in 13.2.3 · NVD
  18. High 7.2

    CVE-2020-13290 · GitLab

    In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page

    Published 12 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  19. Medium 4.8

    CVE-2020-13288 · GitLab

    In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page

    Published 12 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  20. Medium 5.4

    CVE-2020-13294 · GitLab

    In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.

    Published 10 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  21. High 7.1

    CVE-2020-13293 · GitLab

    In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.

    Published 10 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  22. Critical 9.6

    CVE-2020-13292 · GitLab

    In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.

    Published 10 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  23. High 7.5

    CVE-2020-9490 · Apache HTTP Server

    Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

    Published 7 Aug 2020 · Fixed in 2.4.46 · NVD
  24. High 7.5

    CVE-2020-11993 · Apache HTTP Server

    Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

    Published 7 Aug 2020 · Fixed in 2.4.44 · NVD
  25. Medium 5.3

    CVE-2020-11985 · Apache HTTP Server

    IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

    Published 7 Aug 2020 · NVD
  26. Critical 9.8

    CVE-2020-11984 · Apache HTTP Server

    Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

    Published 7 Aug 2020 · NVD
  27. Medium 6.5

    CVE-2020-9692 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  28. Critical 9.6

    CVE-2020-9691 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  29. Medium 4.2

    CVE-2020-9690 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  30. Medium 6.5

    CVE-2020-9689 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  31. High 8.1

    CVE-2020-8174 · Node.js

    napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

    Published 24 Jul 2020 · Fixed in 10.21.0, 12.18.0, 14.4.0 · NVD
  32. Medium 4.9

    CVE-2020-14725 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 24 Jul 2020 · NVD
  33. High 7.4

    CVE-2020-15778 · OpenSSH

    scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

    Published 24 Jul 2020 · Fixed in 8.3 · NVD
  34. Medium 5.4

    CVE-2020-14175 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2.

    Published 24 Jul 2020 · Fixed in 7.4.2, 7.5.2 · NVD
  35. Medium 6.1

    CVE-2020-9665 · Magento / Adobe Commerce

    Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 22 Jul 2020 · NVD
  36. Critical 9.8

    CVE-2020-9664 · Magento / Adobe Commerce

    Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 22 Jul 2020 · NVD
  37. Critical 9.8

    CVE-2020-15801 · Python

    In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.

    Published 17 Jul 2020 · Fixed in 3.7.9, 3.8.5 · NVD
  38. Medium 5.4

    CVE-2020-35946 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 16 Jul 2020 · Fixed in 3.6.2 · NVD, WPVulnerability
  39. Medium 4.9

    CVE-2020-14702 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Jul 2020 · NVD
  40. High 7.2

    CVE-2020-14697 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score…

    Published 15 Jul 2020 · NVD
  41. Medium 6.5

    CVE-2020-14680 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Jul 2020 · NVD
  42. High 7.2

    CVE-2020-14678 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score…

    Published 15 Jul 2020 · NVD
  43. High 8.3

    CVE-2020-14664 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE,…

    Published 15 Jul 2020 · NVD
  44. High 7.2

    CVE-2020-14663 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score…

    Published 15 Jul 2020 · NVD
  45. Medium 4.9

    CVE-2020-14656 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Jul 2020 · NVD
  46. Medium 4.9

    CVE-2020-14654 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Jul 2020 · NVD
  47. Medium 5.5

    CVE-2020-14651 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Jul 2020 · NVD
  48. Medium 5.5

    CVE-2020-14643 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Jul 2020 · NVD
  49. Medium 4.9

    CVE-2020-14641 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete…

    Published 15 Jul 2020 · NVD
  50. Low 2.7

    CVE-2020-14634 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data.…

    Published 15 Jul 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.