Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,068
- Published in 7 days
- 642
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,068 vulnerabilities- Medium 4.3
CVE-2022-21642 · Discourse
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.
Published 5 Jan 2022 · Fixed in 2.7.13 · NVD - Critical 9.1
CVE-2021-43816 · containerd
containerd CRI plugin: Unprivileged pod using `hostPath` can side-step SELinux
Published 5 Jan 2022 · Fixed in 1.5.9 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2021-43946 · Jira
Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from version 8.14.0 before 8.20.9.
Published 5 Jan 2022 · Fixed in 8.13.21, 8.20.9 · NVD - High 7.8
CVE-2021-22045 · VMware ESXi
VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor…
Published 4 Jan 2022 · NVD - Medium 6.8
CVE-2021-43850 · Discourse
Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_diagnostics` path. The impact of this vulnerability is greater on multisite Discourse instances (where multiple forums are served from a single application server) where any admin user on any of the forums are able to visit the…
Published 4 Jan 2022 · Fixed in 2.7.12 · NVD - High 7.8Actively exploited
CVE-2021-44168 · Fortinet FortiOS
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Published 4 Jan 2022 · Fixed in 6.2.10, 6.4.8, 7.0.3 · NVD - Medium 6.1
CVE-2021-43942 · Jira
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0…
Published 4 Jan 2022 · Fixed in 8.20.3 · NVD - Medium 5.4
CVE-2022-22293 · Dolibarr ERP CRM
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.
Published 2 Jan 2022 · NVD - High 8.8
CVE-2021-45960 · Expat
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Published 1 Jan 2022 · Fixed in 2.4.3 · NVD - High 7.5
CVE-2021-41819 · Ruby
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
Published 1 Jan 2022 · Fixed in 2.7.5, 3.0.3 · NVD - High 7.5
CVE-2021-41817 · Ruby
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
Published 1 Jan 2022 · Fixed in 2.6.9, 2.7.5, 3.0.3 · NVD - Medium 5.5
CVE-2021-45949 · Ghostscript
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
Published 1 Jan 2022 · NVD - Medium 5.5
CVE-2021-45944 · Ghostscript
Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp).
Published 1 Jan 2022 · NVD - Medium 6.6
CVE-2021-44832 · Apache Log4j, Oracle WebLogic Server
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4,…
Published 28 Dec 2021 · Fixed in 2.3.2, 2.12.4, 2.17.1 · NVD - Medium 6.1
CVE-2021-25089 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting
Published 28 Dec 2021 · Fixed in 1.16.69 · NVD, WPVulnerability - High 8.8
CVE-2021-43858 · MinIO
MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There…
Published 27 Dec 2021 · Fixed in 2021-12-27t07-23-18z · NVD - Medium 6.1
CVE-2021-45474 · MediaWiki
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.
Published 24 Dec 2021 · NVD - Medium 6.1
CVE-2021-45473 · MediaWiki
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
Published 24 Dec 2021 · NVD - Medium 6.1
CVE-2021-45472 · MediaWiki
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
Published 24 Dec 2021 · NVD - Medium 5.3
CVE-2021-45471 · MediaWiki
In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.
Published 24 Dec 2021 · NVD - Medium 6.5
CVE-2021-4024 · Podman
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in…
Published 23 Dec 2021 · Fixed in 3.4.3 · NVD - Critical 9.8
CVE-2021-44548 · Apache Solr
An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM…
Published 23 Dec 2021 · Fixed in 8.11.1 · NVD - Medium 6.1
CVE-2012-20001 · PrestaShop
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
Published 21 Dec 2021 · Fixed in 1.5.2 · NVD - Critical 9.0
CVE-2021-4139 · Pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published 21 Dec 2021 · Fixed in 10.2.7 · NVD - High 8.8
CVE-2021-3860 · JFrog Artifactory
JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.
Published 20 Dec 2021 · Fixed in 7.23.8, 7.24.7, 7.25.4 · NVD - High
CVE-2021-4133 · Keycloak
Incorrect authorization allows unpriviledged users to create other users
Published 20 Dec 2021 · Fixed in 16.0.0 · Project advisories (GitHub) - Critical 9.8
CVE-2021-44790 · Apache HTTP Server
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Published 20 Dec 2021 · Fixed in 2.4.52 · NVD - High 8.2
CVE-2021-44224 · Apache HTTP Server
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Published 20 Dec 2021 · Fixed in 2.4.52 · NVD - High 7.5
CVE-2021-44858 · MediaWiki
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.
Published 20 Dec 2021 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD - Medium 5.9
CVE-2021-45105 · Apache Log4j, Oracle WebLogic Server
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Published 18 Dec 2021 · Fixed in 2.3.1, 2.12.3 · NVD - High 8.8
CVE-2021-4130 · Snipe-IT
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Published 18 Dec 2021 · Fixed in 5.3.6 · NVD - Critical 9.8
CVE-2021-23450 · Oracle WebLogic Server
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
Published 17 Dec 2021 · NVD - Medium 5.7
CVE-2021-37863 · Mattermost
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.
Published 17 Dec 2021 · NVD - Medium 5.4
CVE-2021-37862 · Mattermost
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.
Published 17 Dec 2021 · NVD - Medium 4.9
CVE-2021-45042 · HashiCorp Vault
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
Published 17 Dec 2021 · Fixed in 1.7.7, 1.8.6 · NVD - Medium 5.3
CVE-2021-45038 · MediaWiki
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents.
Published 17 Dec 2021 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD - Medium 6.5
CVE-2021-44857 · MediaWiki
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.
Published 17 Dec 2021 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD - Medium 6.1
CVE-2020-18985 · Zimbra Collaboration
An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
Published 15 Dec 2021 · NVD - Medium 6.1
CVE-2020-18984 · Zimbra Collaboration
A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.
Published 15 Dec 2021 · NVD - High 8.8
CVE-2021-43877 · .NET
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
Published 15 Dec 2021 · NVD - Medium 6.5
CVE-2021-20330 · MongoDB
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.
Published 15 Dec 2021 · Fixed in 4.0.25, 4.2.14, 4.4.6 · NVD - Medium 5.4
CVE-2021-42220 · Dolibarr ERP CRM
A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box.
Published 15 Dec 2021 · Fixed in 14.0.3 · NVD - Medium 6.1
CVE-2021-4108 · Snipe-IT
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published 14 Dec 2021 · Fixed in 5.3.5 · NVD - High 7.5
CVE-2021-4044 · Node.js, OpenSSL
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent…
Published 14 Dec 2021 · Fixed in 1.0.2, 17.3.0 · NVD - Critical 9.0Actively exploited
CVE-2021-45046 · Apache Log4j
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft…
Published 14 Dec 2021 · Fixed in 2.12.2, 2.16.0 · NVD - Medium 6.1
CVE-2018-10228 · LimeSurvey
Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.
Published 14 Dec 2021 · NVD - High 8.8
CVE-2021-43830 · OpenProject
SQL injection in OpenProject budgets reassignment
Published 14 Dec 2021 · Fixed in 12.0.4 · NVD, Project advisories (GitHub) - High 7.5
CVE-2021-4104 · Apache Log4j, Oracle WebLogic Server
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2…
Published 14 Dec 2021 · NVD - Medium 6.5
CVE-2021-25037 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): SQL Injection
Published 14 Dec 2021 · Fixed in 4.1.5.3 · WPVulnerability - High 8.8
CVE-2021-25036 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Improper Handling of Case Sensitivity
Published 14 Dec 2021 · Fixed in 4.1.5.3 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.