UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,262
Published in 7 days
277
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,262 vulnerabilities
  1. Critical 9.8

    CVE-2020-9632 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  2. Critical 9.8

    CVE-2020-9631 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  3. Critical 9.8

    CVE-2020-9630 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation could lead to privilege escalation.

    Published 26 Jun 2020 · NVD
  4. High 7.5

    CVE-2020-9591 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel.

    Published 26 Jun 2020 · NVD
  5. High 7.2

    CVE-2020-9588 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

    Published 26 Jun 2020 · NVD
  6. High 7.5

    CVE-2020-9587 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.

    Published 26 Jun 2020 · NVD
  7. Critical 9.8

    CVE-2020-9585 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  8. Medium 5.4

    CVE-2020-9584 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 26 Jun 2020 · NVD
  9. Critical 9.8

    CVE-2020-9583 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  10. Critical 9.8

    CVE-2020-9582 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  11. Medium 6.1

    CVE-2020-9581 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 26 Jun 2020 · NVD
  12. Critical 9.8

    CVE-2020-9580 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  13. Critical 9.8

    CVE-2020-9579 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  14. Critical 9.8

    CVE-2020-9578 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  15. Medium 6.1

    CVE-2020-9577 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure .

    Published 26 Jun 2020 · NVD
  16. Critical 9.8

    CVE-2020-9576 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  17. High 7.5

    CVE-2020-11996 · Apache Tomcat

    A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

    Published 26 Jun 2020 · NVD
  18. Low 3.1

    CVE-2020-15005 · MediaWiki

    In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.

    Published 24 Jun 2020 · Fixed in 1.31.8, 1.33.4, 1.34.2 · NVD
  19. Unrated

    WPV-f2795989d403 · WooCommerce

    Vulnerability in WooCommerce

    Published 22 Jun 2020 · Fixed in 4.2.1 · WPVulnerability
  20. Medium 5.3

    CVE-2020-13264 · GitLab

    Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  21. High 8.8

    CVE-2020-13263 · GitLab

    An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  22. Low 2.7

    CVE-2020-13261 · GitLab

    Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  23. Medium 4.3

    CVE-2020-13276 · GitLab

    User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  24. High 8.1

    CVE-2020-13275 · GitLab

    A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  25. High 7.5

    CVE-2020-13274 · GitLab

    A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  26. High 7.5

    CVE-2020-13273 · GitLab

    A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  27. High 8.8

    CVE-2020-13272 · GitLab

    OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  28. Medium 5.3

    CVE-2020-13265 · GitLab

    User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  29. Medium 6.1

    CVE-2020-13262 · GitLab

    Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  30. High 8.8

    CVE-2019-20891 · WooCommerce

    WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.

    Published 19 Jun 2020 · Fixed in 3.6.5 · NVD
  31. Medium 6.5

    CVE-2020-13277 · GitLab

    An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5

    Published 19 Jun 2020 · NVD
  32. Medium 5.9

    CVE-2020-14422 · Python

    Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10,…

    Published 18 Jun 2020 · Fixed in 3.6.12, 3.7.9, 3.8.4 · NVD
  33. Medium 5.3

    CVE-2020-14155 · GitLab

    libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

    Published 15 Jun 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  34. Medium 5.4

    CVE-2020-4046 · WordPress

    WordPress: Authenticated XSS through embed block

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  35. Medium 6.8

    CVE-2020-4047 · WordPress

    WordPress: Authenticated XSS via media attachment page

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  36. Medium 5.7

    CVE-2020-4048 · WordPress

    WordPress: Open redirect in wp_validate_redirect()

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  37. Low 2.4

    CVE-2020-4049 · WordPress

    WordPress: Authenticated self-XSS via theme uploads

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  38. Low 3.1

    CVE-2020-4050 · WordPress

    WordPress: 'set-screen-option' filter misuse by plugins leading to privilege escalation

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  39. Medium 6.1

    CVE-2020-13271 · GitLab

    A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1

    Published 10 Jun 2020 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
  40. High 8.8

    CVE-2020-13270 · GitLab

    Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API

    Published 10 Jun 2020 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
  41. Medium 6.1

    CVE-2020-13269 · GitLab

    A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1

    Published 10 Jun 2020 · Fixed in 12.10.7, 13.0.1 · NVD
  42. Medium 5.3

    CVE-2020-13268 · GitLab

    A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1

    Published 10 Jun 2020 · NVD
  43. Medium 6.1

    CVE-2020-13267 · GitLab

    A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1

    Published 10 Jun 2020 · NVD
  44. Medium 6.1

    CVE-2020-36172 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Cross-site Scripting

    Published 10 Jun 2020 · Fixed in 5.8.12 · NVD, WPVulnerability
  45. Medium 4.3

    CVE-2020-13266 · GitLab

    Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions

    Published 9 Jun 2020 · NVD
  46. High 7.4

    CVE-2020-8172 · Node.js

    TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

    Published 8 Jun 2020 · Fixed in 12.18.0, 14.4.0 · NVD
  47. Medium 5.4

    CVE-2020-13865 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 5 Jun 2020 · Fixed in 2.9.10 · WPVulnerability
  48. Medium 5.4

    CVE-2020-13864 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 5 Jun 2020 · Fixed in 2.9.9 · WPVulnerability
  49. High 7.5

    CVE-2020-11080 · Node.js, MySQL

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this…

    Published 3 Jun 2020 · Fixed in 10.21.0, 12.18.0 · NVD
  50. High 8.8

    CVE-2020-7014 · Elasticsearch

    The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with…

    Published 3 Jun 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.