UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,068
Published in 7 days
640
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,068 vulnerabilities
  1. Medium 6.7

    CVE-2021-42757 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

    Published 8 Dec 2021 · NVD
  2. High 8.8

    CVE-2021-36180 · Fortinet FortiWeb

    Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.

    Published 8 Dec 2021 · NVD
  3. High 7.8

    CVE-2021-26110 · Fortinet FortiProxy, Fortinet FortiOS

    An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script and auto-script features.

    Published 8 Dec 2021 · NVD
  4. High 7.5

    CVE-2021-42717 · ModSecurity

    ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2…

    Published 7 Dec 2021 · Fixed in 2.9.5, 3.0.6 · NVD
  5. Medium

    CVE-2021-43808 · Laravel

    Blade `@parent` Exploitation Leading To Possible XSS

    Published 7 Dec 2021 · Fixed in 6.20.42 · Project advisories (GitHub)
  6. High 7.5Actively exploited

    CVE-2021-43798 · Grafana

    Grafana path traversal

    Published 7 Dec 2021 · Fixed in 8.0.7, 8.1.8, 8.2.7 · NVD, Project advisories (GitHub)
  7. High 7.0

    CVE-2021-28703 · Xen

    grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor…

    Published 7 Dec 2021 · Fixed in 14.4 · NVD
  8. Critical 9.8

    CVE-2021-43789 · PrestaShop

    Blind SQLi using Search filters

    Published 7 Dec 2021 · Fixed in 1.7.8.2 · NVD, Project advisories (GitHub)
  9. Critical 9.8

    CVE-2021-39890 · GitLab

    It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.

    Published 6 Dec 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  10. High 7.5

    CVE-2021-22170 · GitLab

    Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content

    Published 6 Dec 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  11. Medium 6.8

    CVE-2021-35245 · SolarWinds Serv-U

    When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.

    Published 6 Dec 2021 · Fixed in 15.2.4 · NVD
  12. High 8.8

    CVE-2021-35242 · SolarWinds Serv-U

    Serv-U server responds with valid CSRFToken when the request contains only Session.

    Published 6 Dec 2021 · Fixed in 15.2.5 · NVD
  13. High

    CVE-2021-43803 · Next.js

    Unexpected server crash in Next.js versions above 11.1.0 and below 12.0.5

    Published 6 Dec 2021 · Fixed in 11.1.3 · Project advisories (GitHub)
  14. Medium 5.0

    CVE-2021-43784 · runc

    Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration

    Published 6 Dec 2021 · Fixed in 1.0.3 · NVD, Project advisories (GitHub)
  15. Medium 6.1

    CVE-2021-25022 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 6 Dec 2021 · Fixed in 1.16.66 · NVD, WPVulnerability
  16. Medium 4.8

    CVE-2021-35415 · Chamilo LMS

    A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the course "Title" and "Content" fields.

    Published 3 Dec 2021 · NVD
  17. Critical 9.8

    CVE-2021-35414 · Chamilo LMS

    Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.

    Published 3 Dec 2021 · NVD
  18. High 8.8

    CVE-2021-35413 · Chamilo LMS

    A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file.

    Published 3 Dec 2021 · NVD
  19. Medium 6.5

    CVE-2021-20867 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 2 Dec 2021 · Fixed in 5.11, 5.12.1 · NVD, WPVulnerability
  20. Medium 6.5

    CVE-2021-20866 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Missing Authorization

    Published 2 Dec 2021 · Fixed in 5.11 · NVD, WPVulnerability
  21. High 7.5

    CVE-2021-20865 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Missing Authorization

    Published 2 Dec 2021 · Fixed in 5.11 · NVD, WPVulnerability
  22. Medium 5.3

    CVE-2021-43794 · Discourse

    Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

    Published 1 Dec 2021 · Fixed in 2.7.11 · NVD
  23. Medium 4.3

    CVE-2021-43793 · Discourse

    Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse

    Published 1 Dec 2021 · Fixed in 2.7.11 · NVD
  24. Medium 4.3

    CVE-2021-43792 · Discourse

    Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications…

    Published 1 Dec 2021 · Fixed in 2.7.11 · NVD
  25. Medium 5.4

    CVE-2021-4018 · Snipe-IT

    snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Published 1 Dec 2021 · Fixed in 5.3.3 · NVD
  26. High 7.2

    CVE-2021-40101 · Concrete CMS

    An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password.

    Published 30 Nov 2021 · Fixed in 8.5.7 · NVD
  27. Critical 9.8

    CVE-2021-43202 · TeamCity

    In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.

    Published 30 Nov 2021 · Fixed in 2021.1.3 · NVD
  28. Medium 6.5

    CVE-2021-43998 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

    Published 30 Nov 2021 · NVD
  29. Medium 6.1

    CVE-2021-24964 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 30 Nov 2021 · Fixed in 4.4.4 · NVD, WPVulnerability
  30. Medium 4.8

    CVE-2021-24963 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 30 Nov 2021 · Fixed in 4.4.4 · NVD, WPVulnerability
  31. Medium 5.3

    CVE-2021-21707 · PHP

    In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to…

    Published 29 Nov 2021 · Fixed in 7.3.33, 7.4.26, 8.0.13 · NVD
  32. Critical 9.8

    CVE-2021-44223 · WordPress

    WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

    Published 25 Nov 2021 · Fixed in 5.8 · NVD
  33. Critical 9.8

    CVE-2021-22049 · VMware vCenter Server

    The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

    Published 24 Nov 2021 · NVD
  34. High 7.5

    CVE-2021-21980 · VMware vCenter Server

    The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

    Published 24 Nov 2021 · NVD
  35. Medium 6.5

    CVE-2021-32037 · MongoDB

    An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and…

    Published 24 Nov 2021 · NVD
  36. Medium

    CVE-2021-41267 · Symfony

    Webcache Poisoning via X-Forwarded-Prefix and sub-request

    Published 24 Nov 2021 · Fixed in 5.3.12 · Project advisories (GitHub)
  37. Medium

    CVE-2021-41268 · Symfony

    Remember me cookie persistance after password changes

    Published 24 Nov 2021 · Fixed in 5.3.12 · Project advisories (GitHub)
  38. High 7.8

    CVE-2021-28709 · Xen

    issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via…

    Published 24 Nov 2021 · NVD
  39. High 7.8

    CVE-2021-28705 · Xen

    issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via…

    Published 24 Nov 2021 · NVD
  40. High 8.8

    CVE-2021-28708 · Xen

    PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These…

    Published 24 Nov 2021 · NVD
  41. High 8.8

    CVE-2021-28707 · Xen

    PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These…

    Published 24 Nov 2021 · NVD
  42. High 8.6

    CVE-2021-28706 · Xen

    guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the…

    Published 24 Nov 2021 · Fixed in 4.12 · NVD
  43. High 8.8

    CVE-2021-28704 · Xen

    PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These…

    Published 24 Nov 2021 · NVD
  44. Medium 5.6

    CVE-2021-3672 · c-ares, Node.js

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

    Published 23 Nov 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD
  45. Medium 5.3

    CVE-2021-43560 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.

    Published 22 Nov 2021 · Fixed in 3.9.11, 3.10.8, 3.11.4 · NVD
  46. High 8.8

    CVE-2021-43559 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

    Published 22 Nov 2021 · Fixed in 3.9.11, 3.10.8, 3.11.4 · NVD
  47. Medium 6.1

    CVE-2021-43558 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.

    Published 22 Nov 2021 · Fixed in 3.9.11, 3.10.8, 3.11.4 · NVD
  48. Critical 9.8

    CVE-2021-3943 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified.

    Published 22 Nov 2021 · NVD
  49. High 7.5

    CVE-2021-43557 · Apache APISIX

    The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same…

    Published 22 Nov 2021 · Fixed in 2.10.2 · NVD
  50. High 8.8

    CVE-2021-28710 · Xen

    certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable hardware, by default will) be shared between CPUs, for second-level translation (EPT), and IOMMUs. These page tables are presently set up to always be 4 levels deep. However, an IOMMU may require the use of just 3 page table levels. In such…

    Published 21 Nov 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.