UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,262
Published in 7 days
277
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,262 vulnerabilities
  1. High 7.5

    CVE-2020-13763 · Joomla!

    In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  2. Medium 6.1

    CVE-2020-13762 · Joomla!

    In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  3. Medium 6.1

    CVE-2020-13761 · Joomla!

    In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  4. High 8.8

    CVE-2020-13760 · Joomla!

    In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  5. Medium 6.1

    CVE-2020-10959 · MediaWiki

    resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.

    Published 2 Jun 2020 · Fixed in 1.35 · NVD
  6. High 7.5

    CVE-2020-12062 · OpenSSH

    The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing,…

    Published 1 Jun 2020 · NVD
  7. High 7.5

    CVE-2020-1161 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests…

    Published 21 May 2020 · NVD
  8. High 7.5

    CVE-2020-1108 · .NET

    A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing…

    Published 21 May 2020 · NVD
  9. Unrated

    WPV-4a82883d2f55 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 21 May 2020 · Fixed in 1.6.0.2 · WPVulnerability
  10. Medium 4.3

    CVE-2020-8934 · Google Site Kit (WordPress plugin)

    Site Kit by Google – Analytics, Search Console, AdSense, Speed: Unchecked Return Value

    Published 21 May 2020 · Fixed in 1.8.0 · WPVulnerability
  11. High 7.0

    CVE-2020-9484 · Apache Tomcat

    When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a…

    Published 20 May 2020 · Fixed in 7.0.108, 8.5.63, 9.0.43 · NVD
  12. Medium 5.3

    CVE-2019-11048 · PHP

    In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of…

    Published 20 May 2020 · Fixed in 7.2.31, 7.3.18, 7.4.6 · NVD
  13. Unrated

    WPV-43353581c268 · Google Site Kit (WordPress plugin)

    Vulnerability in Site Kit by Google – Analytics, Search Console, AdSense, Speed

    Published 13 May 2020 · Fixed in 1.8.0 · WPVulnerability
  14. Medium 5.4

    CVE-2020-8155 · Nextcloud

    An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.

    Published 12 May 2020 · Fixed in 18.0.3 · NVD
  15. High 7.7

    CVE-2020-8154 · Nextcloud

    An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.

    Published 12 May 2020 · Fixed in 17.0.5, 18.0.3 · NVD
  16. Medium 5.3

    CVE-2020-12448 · GitLab

    GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.

    Published 7 May 2020 · Fixed in 12.8.10 · NVD
  17. Medium 5.3

    CVE-2020-7921 · MongoDB

    Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3; MongoDB Server v4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and…

    Published 6 May 2020 · Fixed in 4.0.15, 4.2.3, 4.3.3 · NVD
  18. Unrated

    WPV-96eee1589add · WooCommerce

    Vulnerability in WooCommerce

    Published 5 May 2020 · Fixed in 4.1.0 · WPVulnerability
  19. Medium 5.3

    CVE-2020-10933 · Ruby

    An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.

    Published 4 May 2020 · NVD
  20. Medium 5.4

    CVE-2020-11025 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress Customizer

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  21. Medium 5.4

    CVE-2020-11026 · WordPress

    Specially crafted filenames in WordPress leading to XSS

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  22. High 8.1

    CVE-2020-11027 · WordPress

    Password reset links invalidation issue in WordPress

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  23. High 7.5

    CVE-2020-11028 · WordPress

    WordPress: Unauthenticated disclosure of certain private posts

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  24. Medium 6.1

    CVE-2020-11029 · WordPress

    WordPress: Cross-site scripting in stats method (object cache)

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  25. Medium 5.4

    CVE-2020-11030 · WordPress

    Cross-site scripting (XSS) in Search block - WordPress

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  26. Medium 6.9Actively exploited

    CVE-2020-11023 · org.webjars.npm:jquery, jQuery, components/jquery and 1 more

    Potential XSS vulnerability in jQuery

    Published 29 Apr 2020 · Fixed in 3.5.0, 4.4.0 · OSV.dev and GitHub
  27. Medium 6.9

    CVE-2020-11022 · org.webjars.npm:jquery, jquery, athlon1600/youtube-downloader and 4 more

    Potential XSS vulnerability in jQuery

    Published 29 Apr 2020 · Fixed in 3.5.0, 4.0.1, 4.4.0 · OSV.dev and GitHub
  28. Medium 5.3

    CVE-2020-12277 · GitLab

    GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.

    Published 29 Apr 2020 · Fixed in 12.7.8, 12.8.8, 12.9.1 · NVD
  29. Medium 4.8

    CVE-2020-12276 · GitLab

    GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.

    Published 29 Apr 2020 · Fixed in 12.7.8, 12.8.8, 12.9.1 · NVD
  30. Medium 5.3

    CVE-2020-12275 · GitLab

    GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.

    Published 29 Apr 2020 · Fixed in 12.7.8, 12.8.8, 12.9.1 · NVD
  31. High 7.5

    CVE-2020-7067 · PHP

    In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

    Published 27 Apr 2020 · Fixed in 7.2.30, 7.3.17, 7.4.5 · NVD
  32. Medium 6.5

    CVE-2020-11649 · GitLab

    An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted.

    Published 22 Apr 2020 · Fixed in 12.7.9, 12.8.9, 12.9.3 · NVD
  33. High 7.5

    CVE-2020-11506 · GitLab

    An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) via request smuggling.

    Published 22 Apr 2020 · Fixed in 12.7.9, 12.8.9, 12.9.3 · NVD
  34. High 7.5

    CVE-2020-11505 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.

    Published 22 Apr 2020 · Fixed in 12.7.9, 12.8.9, 12.9.3 · NVD
  35. Medium 6.1

    CVE-2019-20102 · Confluence

    The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter.

    Published 22 Apr 2020 · Fixed in 6.15.5 · NVD
  36. Medium 5.3

    CVE-2020-11891 · Joomla!

    An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.

    Published 21 Apr 2020 · Fixed in 3.9.17 · NVD
  37. Medium 5.3

    CVE-2020-11890 · Joomla!

    An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.

    Published 21 Apr 2020 · Fixed in 3.9.17 · NVD
  38. Medium 5.3

    CVE-2020-11889 · Joomla!

    An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.

    Published 21 Apr 2020 · Fixed in 3.9.17 · NVD
  39. High 7.5

    CVE-2020-1967 · OpenSSL, MySQL

    Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service…

    Published 21 Apr 2020 · NVD
  40. Medium 5.4

    CVE-2020-36703 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 21 Apr 2020 · Fixed in 2.9.8 · NVD, WPVulnerability
  41. Medium 6.1

    CVE-2020-11930 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 20 Apr 2020 · Fixed in 2.8.52 · WPVulnerability
  42. Unrated

    WPV-994e6855ed09 · SEO By Rank Math (WordPress plugin)

    Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

    Published 18 Apr 2020 · Fixed in 1.0.42.2 · WPVulnerability
  43. Medium 4.4

    CVE-2020-2930 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · NVD
  44. Medium 4.9

    CVE-2020-2928 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  45. Medium 4.4

    CVE-2020-2926 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  46. Medium 4.9

    CVE-2020-2925 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 15 Apr 2020 · NVD
  47. Medium 4.9

    CVE-2020-2924 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · NVD
  48. Medium 4.9

    CVE-2020-2923 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · NVD
  49. Low 3.7

    CVE-2020-2922 · MariaDB, MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a…

    Published 15 Apr 2020 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD
  50. Medium 4.4

    CVE-2020-2921 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.