UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,263
Published in 7 days
278
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,263 vulnerabilities
  1. High 8.8

    CVE-2020-8420 · Joomla!

    An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.

    Published 28 Jan 2020 · Fixed in 3.9.15 · NVD
  2. High 8.8

    CVE-2020-8419 · Joomla!

    An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.

    Published 28 Jan 2020 · Fixed in 3.9.15 · NVD
  3. Medium 5.5

    CVE-2020-8315 · Python

    In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.

    Published 28 Jan 2020 · NVD
  4. High 8.8

    CVE-2013-4583 · GitLab

    The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories.

    Published 28 Jan 2020 · Fixed in 5.4.2, 6.2.1, 6.2.4 · NVD
  5. Medium 6.5

    CVE-2013-4582 · GitLab

    The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.

    Published 28 Jan 2020 · Fixed in 5.4.2, 6.2.1, 6.2.4 · NVD
  6. Medium 5.3

    CVE-2013-6455 · MediaWiki

    The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

    Published 28 Jan 2020 · Fixed in 1.19.10, 1.21.4, 1.22.1 · NVD
  7. Medium 6.1

    CVE-2013-6451 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.

    Published 28 Jan 2020 · Fixed in 1.19.10, 1.21.4, 1.22.1 · NVD
  8. Medium 6.5

    CVE-2019-5474 · GitLab

    An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  9. High 7.5

    CVE-2019-5472 · GitLab

    An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  10. High 7.5

    CVE-2019-5470 · GitLab

    An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  11. High 8.8

    CVE-2019-5468 · GitLab

    An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  12. Medium 4.3

    CVE-2019-5466 · GitLab

    An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  13. Medium 4.3

    CVE-2019-5465 · GitLab

    An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  14. Critical 9.8

    CVE-2019-5464 · GitLab

    A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  15. High 8.8

    CVE-2019-5462 · GitLab

    A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  16. High 7.5

    CVE-2019-15590 · GitLab

    An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration

    Published 28 Jan 2020 · Fixed in 12.1.14, 12.2.8, 12.3.5 · NVD
  17. Medium 6.1

    CVE-2019-15586 · GitLab

    A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.

    Published 28 Jan 2020 · Fixed in 12.1.10 · NVD
  18. Critical 9.8

    CVE-2019-15585 · GitLab

    Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  19. High 7.5

    CVE-2019-15583 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  20. Medium 5.3

    CVE-2019-15582 · GitLab

    An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  21. Medium 5.3

    CVE-2019-15581 · GitLab

    An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  22. Medium 5.3

    CVE-2019-15579 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  23. Medium 5.3

    CVE-2019-15578 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  24. Medium 5.4

    CVE-2020-8426 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 28 Jan 2020 · Fixed in 2.8.5 · NVD, WPVulnerability
  25. Critical 9.8

    CVE-2015-0244 · PostgreSQL

    PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a…

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  26. High 8.8

    CVE-2015-0243 · PostgreSQL

    Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  27. High 8.8

    CVE-2015-0242 · PostgreSQL

    Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by…

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  28. High 8.8

    CVE-2015-0241 · PostgreSQL

    The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting…

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  29. Medium 5.9

    CVE-2014-9481 · MediaWiki

    The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.

    Published 27 Jan 2020 · Fixed in 1.22.15, 1.23.8, 1.24.1 · NVD
  30. Medium 4.3

    CVE-2014-8161 · PostgreSQL

    PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  31. Medium 5.4

    CVE-2011-3595 · Joomla!

    Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.

    Published 22 Jan 2020 · NVD
  32. Medium 5.3

    CVE-2020-29156 · WooCommerce

    WooCommerce: Authorization Bypass Through User-Controlled Key

    Published 21 Jan 2020 · Fixed in 4.7.0 · NVD, WPVulnerability
  33. Critical 9.8

    CVE-2020-7109 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 19 Jan 2020 · Fixed in 2.8.4 · NVD, WPVulnerability
  34. High 7.5

    CVE-2020-5398 · MySQL

    In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

    Published 17 Jan 2020 · NVD
  35. Low 3.1

    CVE-2020-2694 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.18 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 15 Jan 2020 · NVD
  36. Medium 6.5

    CVE-2020-2686 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Jan 2020 · NVD
  37. Medium 4.9

    CVE-2020-2679 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Jan 2020 · NVD
  38. Medium 4.9

    CVE-2020-2660 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 15 Jan 2020 · NVD
  39. Low 3.7

    CVE-2020-2659 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in…

    Published 15 Jan 2020 · NVD
  40. Medium 4.8

    CVE-2020-2655 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data…

    Published 15 Jan 2020 · NVD
  41. Low 3.7

    CVE-2020-2654 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial…

    Published 15 Jan 2020 · NVD
  42. Medium 6.5

    CVE-2020-2627 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 15 Jan 2020 · NVD
  43. High 8.1

    CVE-2020-2604 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this…

    Published 15 Jan 2020 · NVD
  44. Medium 6.8

    CVE-2020-2601 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE…

    Published 15 Jan 2020 · NVD
  45. Medium 4.8

    CVE-2020-2593 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability…

    Published 15 Jan 2020 · NVD
  46. Low 3.7

    CVE-2020-2590 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result…

    Published 15 Jan 2020 · NVD
  47. Medium 4.9

    CVE-2020-2589 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.28 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Jan 2020 · Fixed in 8.0.18 · NVD
  48. Medium 4.9

    CVE-2020-2588 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 15 Jan 2020 · NVD
  49. Medium 5.9

    CVE-2020-2585 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or…

    Published 15 Jan 2020 · NVD
  50. Medium 4.4

    CVE-2020-2584 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data…

    Published 15 Jan 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.