UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,262
Published in 7 days
277
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,262 vulnerabilities
  1. Medium 5.3

    CVE-2020-10960 · MediaWiki

    In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for…

    Published 3 Apr 2020 · Fixed in 1.34.1 · NVD
  2. High 8.8

    CVE-2020-11100 · HAProxy

    In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

    Published 2 Apr 2020 · Fixed in 2.1.4 · NVD
  3. Medium 6.1

    CVE-2020-1927 · Apache HTTP Server

    In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

    Published 2 Apr 2020 · NVD
  4. Medium 5.3

    CVE-2020-1934 · Apache HTTP Server

    In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.

    Published 1 Apr 2020 · NVD
  5. Medium 4.3

    CVE-2020-7066 · PHP

    In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

    Published 1 Apr 2020 · Fixed in 7.2.29, 7.3.16, 7.4.4 · NVD
  6. High 8.8

    CVE-2020-7065 · PHP

    In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

    Published 1 Apr 2020 · Fixed in 7.3.16, 7.4.4 · NVD
  7. Medium 5.4

    CVE-2020-7064 · PHP

    In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

    Published 1 Apr 2020 · Fixed in 7.2.29, 7.3.16, 7.4.4 · NVD
  8. High 8.8

    CVE-2020-7009 · Elasticsearch

    Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

    Published 31 Mar 2020 · Fixed in 6.8.8, 7.6.2 · NVD
  9. Medium 6.5

    CVE-2020-20634 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 31 Mar 2020 · Fixed in 2.9.6 · NVD, WPVulnerability
  10. Medium 4.4

    CVE-2020-5284 · Next.js

    Directory Traversal in Next.js

    Published 30 Mar 2020 · Fixed in 9.3.2 · OSV.dev and GitHub
  11. Critical 9.8

    CVE-2020-10956 · GitLab

    GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.

    Published 27 Mar 2020 · Fixed in 12.9.1 · NVD
  12. Medium 6.5

    CVE-2020-10955 · GitLab

    GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.

    Published 27 Mar 2020 · Fixed in 12.9.1 · NVD
  13. High 7.5

    CVE-2020-10954 · GitLab

    GitLab through 12.9 is affected by a potential DoS in repository archive download.

    Published 27 Mar 2020 · NVD
  14. High 7.5

    CVE-2020-10953 · GitLab

    In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.

    Published 27 Mar 2020 · NVD
  15. Medium 6.5

    CVE-2020-10952 · GitLab

    GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.

    Published 27 Mar 2020 · NVD
  16. Medium 6.1

    CVE-2020-11515 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Open Redirect

    Published 25 Mar 2020 · Fixed in 1.0.0.41 · WPVulnerability
  17. Critical 9.8

    CVE-2020-11514 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 25 Mar 2020 · Fixed in 1.0.0.41 · WPVulnerability
  18. Medium 6.5

    CVE-2020-8139 · Nextcloud

    A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.

    Published 20 Mar 2020 · Fixed in 16.0.9, 17.0.4, 18.0.1 · NVD
  19. Medium 6.5

    CVE-2020-8138 · Nextcloud

    A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.

    Published 20 Mar 2020 · Fixed in 15.0.14, 16.0.7, 17.0.2 · NVD
  20. Medium 6.5

    CVE-2020-1720 · PostgreSQL

    A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

    Published 17 Mar 2020 · Fixed in 10.12, 11.7, 12.2 · NVD
  21. Critical 9.8

    CVE-2020-10243 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  22. Medium 6.1

    CVE-2020-10242 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  23. High 8.8

    CVE-2020-10241 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  24. Medium 5.3

    CVE-2020-10240 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  25. High 8.8

    CVE-2020-10239 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  26. High 7.5

    CVE-2020-10238 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  27. Critical 9.8

    CVE-2020-10077 · GitLab

    GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk.

    Published 13 Mar 2020 · NVD
  28. Medium 6.1

    CVE-2020-10076 · GitLab

    GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.

    Published 13 Mar 2020 · NVD
  29. Medium 6.1

    CVE-2020-10075 · GitLab

    GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input.

    Published 13 Mar 2020 · NVD
  30. Critical 9.8

    CVE-2020-10074 · GitLab

    GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link.

    Published 13 Mar 2020 · NVD
  31. High 7.5

    CVE-2020-10073 · GitLab

    GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page.

    Published 13 Mar 2020 · NVD
  32. Medium 6.1

    CVE-2020-10092 · GitLab

    GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration.

    Published 13 Mar 2020 · NVD
  33. Medium 6.1

    CVE-2020-10091 · GitLab

    GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.

    Published 13 Mar 2020 · NVD
  34. Medium 5.3

    CVE-2020-10090 · GitLab

    GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed.

    Published 13 Mar 2020 · NVD
  35. High 7.5

    CVE-2020-10089 · GitLab

    GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,

    Published 13 Mar 2020 · NVD
  36. High 8.1

    CVE-2020-10088 · GitLab

    GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level.

    Published 13 Mar 2020 · NVD
  37. High 7.5

    CVE-2020-10087 · GitLab

    GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.

    Published 13 Mar 2020 · NVD
  38. Medium 5.3

    CVE-2020-10086 · GitLab

    GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read.

    Published 13 Mar 2020 · NVD
  39. Medium 5.3

    CVE-2020-10085 · GitLab

    GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles.

    Published 13 Mar 2020 · NVD
  40. Medium 5.3

    CVE-2020-10084 · GitLab

    GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exposure of a private project namespace

    Published 13 Mar 2020 · NVD
  41. Critical 9.1

    CVE-2020-10083 · GitLab

    GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied.

    Published 13 Mar 2020 · NVD
  42. Medium 5.3

    CVE-2020-10082 · GitLab

    GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered.

    Published 13 Mar 2020 · NVD
  43. Medium 6.5

    CVE-2020-10081 · GitLab

    GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user.

    Published 13 Mar 2020 · NVD
  44. Medium 5.3

    CVE-2020-10080 · GitLab

    GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group.

    Published 13 Mar 2020 · NVD
  45. Medium 5.3

    CVE-2020-10079 · GitLab

    GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required.

    Published 13 Mar 2020 · NVD
  46. Medium 6.1

    CVE-2020-10078 · GitLab

    GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.

    Published 13 Mar 2020 · NVD
  47. Medium 5.3

    CVE-2020-10535 · GitLab

    GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address.

    Published 12 Mar 2020 · Fixed in 12.8.6 · NVD
  48. Critical 9.8

    CVE-2020-10534 · MediaWiki

    In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges. This is related to the case in which an IP address is contained in two ranges, one of which is locally disabled.

    Published 12 Mar 2020 · NVD
  49. High 8.8

    CVE-2020-10531 · Node.js

    An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

    Published 12 Mar 2020 · Fixed in 10.21.0 · NVD
  50. High 7.5

    CVE-2013-1753 · Python

    The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.

    Published 11 Mar 2020 · Fixed in 3.2.6, 3.3.6, 3.4.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.