UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,262
Published in 7 days
277
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,262 vulnerabilities
  1. Critical 9.8

    CVE-2019-15605 · Node.js

    HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

    Published 7 Feb 2020 · Fixed in 10.19.0, 12.15.0, 13.8.0 · NVD
  2. High 7.5

    CVE-2019-15604 · Node.js

    Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

    Published 7 Feb 2020 · Fixed in 10.19.0, 12.15.0, 13.8.0 · NVD
  3. High 7.5

    CVE-2013-4572 · MediaWiki

    The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

    Published 6 Feb 2020 · Fixed in 1.19.9, 1.20.8, 1.21.3 · NVD
  4. High 7.8

    CVE-2019-20406 · Confluence

    The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

    Published 6 Feb 2020 · NVD
  5. Critical 9.1

    CVE-2011-1151 · Joomla!

    Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.

    Published 5 Feb 2020 · NVD
  6. High 7.5

    CVE-2020-6833 · GitLab

    An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6, 12.7.4 · NVD
  7. High 7.5

    CVE-2020-7978 · GitLab

    GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.

    Published 5 Feb 2020 · Fixed in 12.6.6 · NVD
  8. Medium 5.3

    CVE-2020-7977 · GitLab

    GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  9. Medium 5.3

    CVE-2020-7976 · GitLab

    GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  10. Medium 5.3

    CVE-2020-7974 · GitLab

    GitLab EE 10.1 through 12.7.2 allows Information Disclosure.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  11. Medium 6.1

    CVE-2020-7973 · GitLab

    GitLab through 12.7.2 allows XSS.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  12. High 7.5

    CVE-2020-7972 · GitLab

    GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6, 12.7.4 · NVD
  13. Medium 6.1

    CVE-2020-7971 · GitLab

    GitLab EE 11.0 and later through 12.7.2 allows XSS.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  14. High 7.5

    CVE-2020-7969 · GitLab

    GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  15. High 7.5

    CVE-2020-7968 · GitLab

    GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6, 12.7.4 · NVD
  16. Medium 4.3

    CVE-2020-7967 · GitLab

    GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).

    Published 5 Feb 2020 · NVD
  17. High 7.5

    CVE-2020-7966 · GitLab

    GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  18. Critical 9.8

    CVE-2020-8114 · GitLab

    GitLab EE 8.9 and later through 12.7.2 has Insecure Permission

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  19. Medium 5.3

    CVE-2020-7979 · GitLab

    GitLab EE 8.9 and later through 12.7.2 has Insecure Permission

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  20. Medium 4.3

    CVE-2020-8122 · Nextcloud

    A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.

    Published 4 Feb 2020 · Fixed in 13.0.8, 14.0.4, 15.0.0 · NVD
  21. High 8.1

    CVE-2020-8121 · Nextcloud

    A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.

    Published 4 Feb 2020 · Fixed in 13.0.9, 14.0.5, 15.0.0 · NVD
  22. Medium 6.1

    CVE-2020-8120 · Nextcloud

    A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.

    Published 4 Feb 2020 · NVD
  23. Medium 4.3

    CVE-2020-8119 · Nextcloud

    Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

    Published 4 Feb 2020 · Fixed in 15.0.13, 16.0.6, 17.0.1 · NVD
  24. Medium 5.0

    CVE-2020-8118 · Nextcloud

    An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.

    Published 4 Feb 2020 · Fixed in 15.0.9, 16.0.2 · NVD
  25. Medium 4.3

    CVE-2020-8117 · Nextcloud

    Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.

    Published 4 Feb 2020 · Fixed in 12.0.13, 13.0.8, 14.0.4 · NVD
  26. Medium 4.9

    CVE-2019-15624 · Nextcloud

    Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.

    Published 4 Feb 2020 · Fixed in 14.0.11, 15.0.8 · NVD
  27. Medium 5.3

    CVE-2019-15623 · Nextcloud

    Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.

    Published 4 Feb 2020 · Fixed in 14.0.13, 15.0.9, 16.0.2 · NVD
  28. Medium 6.5

    CVE-2019-15621 · Nextcloud

    Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.

    Published 4 Feb 2020 · Fixed in 14.0.13, 15.0.9, 16.0.2 · NVD
  29. Medium 4.8

    CVE-2019-15619 · Nextcloud

    Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

    Published 4 Feb 2020 · Fixed in 16.0.4 · NVD
  30. Medium 4.8

    CVE-2019-15618 · Nextcloud

    Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.

    Published 4 Feb 2020 · Fixed in 14.0.9, 15.0.6 · NVD
  31. Medium 5.4

    CVE-2019-15617 · Nextcloud

    A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.

    Published 4 Feb 2020 · Fixed in 17.0.1 · NVD
  32. Medium 4.3

    CVE-2019-15616 · Nextcloud

    Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.

    Published 4 Feb 2020 · Fixed in 17.0.0 · NVD
  33. High 8.0

    CVE-2019-15613 · Nextcloud

    A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.

    Published 4 Feb 2020 · Fixed in 15.0.14, 16.0.7, 17.0.2 · NVD
  34. Medium 5.9

    CVE-2019-15612 · Nextcloud

    A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.

    Published 4 Feb 2020 · Fixed in 13.0.11, 14.0.7, 15.0.3 · NVD
  35. High 7.8

    CVE-2020-7221 · MariaDB

    mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently.

    Published 4 Feb 2020 · NVD
  36. High 7.5

    CVE-2019-9674 · Python

    Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

    Published 4 Feb 2020 · NVD
  37. Medium 5.3

    CVE-2011-4912 · Joomla!

    Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.

    Published 4 Feb 2020 · NVD
  38. High 7.5

    CVE-2011-4937 · Joomla!

    Joomla! 1.7.1 has core information disclosure due to inadequate error checking.

    Published 4 Feb 2020 · Fixed in 1.7.2 · NVD
  39. High 7.5

    CVE-2011-3629 · Joomla!

    Joomla! core 1.7.1 allows information disclosure due to weak encryption

    Published 4 Feb 2020 · Fixed in 1.7.2 · NVD
  40. Medium 6.5

    CVE-2020-8492 · Python

    Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

    Published 30 Jan 2020 · NVD
  41. Medium 6.1

    CVE-2020-3758 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  42. High 7.5

    CVE-2020-3719 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  43. Critical 9.8

    CVE-2020-3718 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jan 2020 · NVD
  44. Medium 5.3

    CVE-2020-3717 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  45. Critical 9.8

    CVE-2020-3716 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jan 2020 · NVD
  46. Medium 6.1

    CVE-2020-3715 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  47. Unrated

    WPV-9ebdb28ccadd · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 29 Jan 2020 · Fixed in 2.7.6 · WPVulnerability
  48. Unrated

    WPV-97c7bb986b1b · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 29 Jan 2020 · Fixed in 2.7.6 · WPVulnerability
  49. Medium 6.1

    CVE-2020-8421 · Joomla!

    An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.

    Published 28 Jan 2020 · Fixed in 3.9.14 · NVD
  50. High 8.8

    CVE-2020-8420 · Joomla!

    An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.

    Published 28 Jan 2020 · Fixed in 3.9.15 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.