Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,068
- Published in 7 days
- 641
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,068 vulnerabilities- Low 2.7
CVE-2021-39945 · GitLab
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - High 7.1
CVE-2021-39944 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 5.3
CVE-2021-39941 · GitLab
An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 6.5
CVE-2021-39940 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 6.5
CVE-2021-39939 · GitLab
An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker triggering a job with a specially crafted docker image to exhaust resources on runner manager
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 6.5
CVE-2021-39938 · GitLab
A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - High 8.8
CVE-2021-39937 · GitLab
A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39936 · GitLab
Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker in possession of a deploy token to access a project's disabled wiki.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - High 7.5Actively exploited
CVE-2021-39935 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39934 · GitLab
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 6.5
CVE-2021-39933 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a DOS attack.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39932 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39931 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39930 · GitLab
Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.4
CVE-2021-39919 · GitLab
In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39918 · GitLab
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 6.5
CVE-2021-39917 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a DOS attack.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39916 · GitLab
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 5.3
CVE-2021-39915 · GitLab
Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 4.3
CVE-2021-39910 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature.
Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD - Medium 6.0
CVE-2021-36169 · Fortinet FortiOS
A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific hex read/write operations.
Published 13 Dec 2021 · Fixed in 6.2.10, 6.4.7 · NVD - Medium 4.3
CVE-2021-43815 · Grafana
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated…
Published 10 Dec 2021 · Fixed in 7.5.12, 8.3.2 · NVD - Medium 4.3
CVE-2021-4089 · Snipe-IT
snipe-it is vulnerable to Improper Access Control
Published 10 Dec 2021 · NVD - Medium 4.3
CVE-2021-43813 · Grafana
CVE-2021-43813: Grafana directory traversal for `.md` files, 5.0.0 - 8.3.1
Published 10 Dec 2021 · Fixed in 7.5.12, 8.3.2 · NVD, Project advisories (GitHub) - Medium 6.1
CVE-2021-4084 · Pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published 10 Dec 2021 · Fixed in 10.2.6 · NVD - Medium 4.3
CVE-2021-4082 · Pimcore
pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
Published 10 Dec 2021 · Fixed in 10.2.6 · NVD - Medium 6.1
CVE-2021-4081 · Pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published 10 Dec 2021 · Fixed in 10.2.6 · NVD - Critical 10.0Actively exploited
CVE-2021-44228 · Apache Log4j
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is…
Published 10 Dec 2021 · Fixed in 2.3.1, 2.12.2, 2.15.0 · NVD - High 7.5
CVE-2021-37861 · Mattermost
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.
Published 9 Dec 2021 · NVD - High 7.5
CVE-2021-38951 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 211405.
Published 9 Dec 2021 · NVD - High 8.8
CVE-2021-43071 · Fortinet FortiWeb
A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller.
Published 9 Dec 2021 · NVD - High 8.8
CVE-2021-36194 · Fortinet FortiWeb
Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests.
Published 9 Dec 2021 · NVD - Critical 9.8
CVE-2021-41025 · Fortinet FortiWeb
Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of authentication bypass by capture-replay, may allow a remote unauthenticated attacker to circumvent the…
Published 8 Dec 2021 · NVD - High 8.8
CVE-2021-41017 · Fortinet FortiWeb
Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.
Published 8 Dec 2021 · NVD - High 8.8
CVE-2021-36195 · Fortinet FortiWeb
Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments.
Published 8 Dec 2021 · NVD - High 8.8
CVE-2021-36173 · Fortinet FortiOS
A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images.
Published 8 Dec 2021 · NVD - Medium 5.3
CVE-2021-41013 · Fortinet FortiWeb
An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.
Published 8 Dec 2021 · NVD - Medium 6.1
CVE-2021-36188 · Fortinet FortiWeb
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers
Published 8 Dec 2021 · Fixed in 6.3.16, 6.4.2 · NVD - Medium 6.1
CVE-2021-43063 · Fortinet FortiWeb
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage.
Published 8 Dec 2021 · NVD - Medium 6.3
CVE-2021-36190 · Fortinet FortiWeb
A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.
Published 8 Dec 2021 · NVD - Medium 6.1
CVE-2021-43064 · Fortinet FortiWeb
A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to use the device as a proxy and reach external or protected hosts via redirection handlers.
Published 8 Dec 2021 · NVD - High 7.8
CVE-2021-41027 · Fortinet FortiWeb
A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device.
Published 8 Dec 2021 · NVD - High 7.5
CVE-2021-41024 · Fortinet FortiProxy, Fortinet FortiOS
A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page.
Published 8 Dec 2021 · NVD - Medium 6.1
CVE-2021-41015 · Fortinet FortiWeb
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler
Published 8 Dec 2021 · NVD - High 7.5
CVE-2021-41014 · Fortinet FortiWeb
A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets
Published 8 Dec 2021 · NVD - Medium 5.4
CVE-2021-36191 · Fortinet FortiWeb
A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers
Published 8 Dec 2021 · NVD - Critical 9.8
CVE-2021-26109 · Fortinet FortiOS
An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution.
Published 8 Dec 2021 · NVD - High 7.5
CVE-2021-26108 · Fortinet FortiOS
A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.
Published 8 Dec 2021 · NVD - Medium 5.3
CVE-2021-32591 · Fortinet FortiSandbox, Fortinet FortiWeb
A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.
Published 8 Dec 2021 · NVD - High 8.8
CVE-2021-26103 · Fortinet FortiProxy, Fortinet FortiOS
An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6.2.9 and below of SSL VPN portal may allow a remote, unauthenticated attacker to conduct a cross-site request forgery (CSRF) attack . Only SSL VPN in web mode or full mode are impacted by this…
Published 8 Dec 2021 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.