UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,264
Published in 7 days
279
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,264 vulnerabilities
  1. Medium 4.4

    CVE-2020-2584 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data…

    Published 15 Jan 2020 · NVD
  2. Low 3.7

    CVE-2020-2583 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this…

    Published 15 Jan 2020 · NVD
  3. Medium 4.9

    CVE-2020-2580 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 15 Jan 2020 · Fixed in 8.0.18 · NVD
  4. Medium 6.5

    CVE-2020-2579 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 15 Jan 2020 · NVD
  5. Medium 4.9

    CVE-2020-2577 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Jan 2020 · NVD
  6. Medium 5.9

    CVE-2020-2574 · MariaDB, MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause…

    Published 15 Jan 2020 · Fixed in 10.2.31, 10.3.22, 10.4.12 · NVD
  7. Medium 5.9

    CVE-2020-2573 · MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Jan 2020 · NVD
  8. Low 2.7

    CVE-2020-2572 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plugin). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or…

    Published 15 Jan 2020 · NVD
  9. Medium 5.9

    CVE-2020-2570 · MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Jan 2020 · NVD
  10. High 8.8

    CVE-2015-6497 · Magento / Adobe Commerce

    The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.

    Published 15 Jan 2020 · Fixed in 1.9.2.1, 1.14.2.1 · NVD
  11. Medium 5.3

    CVE-2011-4907 · Joomla!

    Joomla! 1.5x through 1.5.12: Missing JEXEC Check

    Published 15 Jan 2020 · NVD
  12. High 7.5

    CVE-2012-1563 · Joomla!

    Joomla! before 2.5.3 allows Admin Account Creation.

    Published 15 Jan 2020 · Fixed in 2.5.3 · NVD
  13. High 7.5

    CVE-2012-1562 · Joomla!

    Joomla! core before 2.5.3 allows unauthorized password change.

    Published 15 Jan 2020 · Fixed in 2.5.3 · NVD
  14. High 8.8

    CVE-2020-0603 · .NET

    A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.

    Published 14 Jan 2020 · NVD
  15. High 7.5

    CVE-2020-0602 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

    Published 14 Jan 2020 · NVD
  16. Medium 5.5

    CVE-2015-2326 · MariaDB, PHP

    The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

    Published 14 Jan 2020 · Fixed in 5.5.26, 5.6.9, 10.0.18 · NVD
  17. High 7.8

    CVE-2015-2325 · MariaDB, PHP

    The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

    Published 14 Jan 2020 · Fixed in 5.5.26, 5.6.9, 10.0.18 · NVD
  18. Medium 4.3

    CVE-2019-20144 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  19. Medium 5.3

    CVE-2019-20143 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  20. Medium 4.3

    CVE-2019-20142 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service.

    Published 13 Jan 2020 · NVD
  21. Medium 5.3

    CVE-2020-6832 · GitLab

    An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects.

    Published 13 Jan 2020 · NVD
  22. Medium 4.3

    CVE-2020-5197 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  23. Medium 5.3

    CVE-2019-20148 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  24. Medium 5.3

    CVE-2019-20147 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  25. Medium 5.3

    CVE-2019-20146 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.

    Published 13 Jan 2020 · NVD
  26. Medium 4.3

    CVE-2019-20145 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  27. Medium 5.3

    CVE-2019-20372 · nginx

    NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

    Published 9 Jan 2020 · Fixed in 1.17.7 · NVD
  28. Low

    CVE-2019-16788 · WordPress

    Users without "publish_posts" rights can mark sticky/unsticky a post via REST API

    Published 8 Jan 2020 · WordPress
  29. High

    CVE-2019-16773 · WordPress

    Stored cross-site scripting (XSS) through 'wp_targeted_link_rel'

    Published 8 Jan 2020 · WordPress
  30. Medium 6.1

    CVE-2020-6163 · MediaWiki

    The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templates/search/PropertySuggestionsWidget.mustache+dom file).

    Published 8 Jan 2020 · NVD
  31. Critical 9.8

    CVE-2020-5519 · OpenLiteSpeed

    The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.

    Published 6 Jan 2020 · Fixed in 1.6.5 · NVD
  32. High 7.5

    CVE-2019-19629 · GitLab

    In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration.

    Published 5 Jan 2020 · NVD
  33. Critical 9.8

    CVE-2019-19628 · GitLab

    In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.

    Published 5 Jan 2020 · NVD
  34. High 7.5

    CVE-2019-19314 · GitLab

    GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext.

    Published 5 Jan 2020 · Fixed in 12.3.8, 12.4.5, 12.5.2 · NVD
  35. High 7.5

    CVE-2019-19313 · GitLab

    GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits.

    Published 5 Jan 2020 · Fixed in 12.3.8, 12.4.5, 12.5.2 · NVD
  36. Medium 5.8

    CVE-2019-19312 · GitLab

    GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API.

    Published 5 Jan 2020 · Fixed in 12.3.8, 12.4.5, 12.5.2 · NVD
  37. Medium 4.9

    CVE-2019-19310 · GitLab

    GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  38. Medium 4.3

    CVE-2019-19309 · GitLab

    GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  39. Medium 4.3

    CVE-2019-19263 · GitLab

    GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  40. Medium 4.3

    CVE-2019-19262 · GitLab

    GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.

    Published 3 Jan 2020 · Fixed in 12.5.2 · NVD
  41. High 8.8

    CVE-2019-19261 · GitLab

    GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  42. Medium 5.4

    CVE-2019-19260 · GitLab

    GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  43. Medium 4.3

    CVE-2019-19259 · GitLab

    GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  44. Medium 5.3

    CVE-2019-19258 · GitLab

    GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  45. Medium 5.3

    CVE-2019-19257 · GitLab

    GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  46. Medium 5.3

    CVE-2019-19256 · GitLab

    GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  47. Medium 4.3

    CVE-2019-19255 · GitLab

    GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  48. Medium 5.4

    CVE-2019-19311 · GitLab

    GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.

    Published 3 Jan 2020 · Fixed in 12.3.7, 12.4.4, 12.5.1 · NVD
  49. Medium 5.3

    CVE-2019-19254 · GitLab

    GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  50. Critical 9.8

    CVE-2019-19088 · GitLab

    Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.