UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,076
Published in 7 days
648
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,076 vulnerabilities
  1. High 8.8

    CVE-2021-28704 · Xen

    PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These…

    Published 24 Nov 2021 · NVD
  2. Medium 5.6

    CVE-2021-3672 · c-ares, Node.js

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

    Published 23 Nov 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD
  3. Medium 5.3

    CVE-2021-43560 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.

    Published 22 Nov 2021 · Fixed in 3.9.11, 3.10.8, 3.11.4 · NVD
  4. High 8.8

    CVE-2021-43559 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

    Published 22 Nov 2021 · Fixed in 3.9.11, 3.10.8, 3.11.4 · NVD
  5. Medium 6.1

    CVE-2021-43558 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.

    Published 22 Nov 2021 · Fixed in 3.9.11, 3.10.8, 3.11.4 · NVD
  6. Critical 9.8

    CVE-2021-3943 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified.

    Published 22 Nov 2021 · NVD
  7. High 7.5

    CVE-2021-43557 · Apache APISIX

    The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same…

    Published 22 Nov 2021 · Fixed in 2.10.2 · NVD
  8. High 8.8

    CVE-2021-28710 · Xen

    certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable hardware, by default will) be shared between CPUs, for second-level translation (EPT), and IOMMUs. These page tables are presently set up to always be 4 levels deep. However, an IOMMU may require the use of just 3 page table levels. In such…

    Published 21 Nov 2021 · NVD
  9. High 7.5

    CVE-2021-22970 · Concrete CMS

    Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5…

    Published 19 Nov 2021 · NVD
  10. Medium 5.3

    CVE-2021-22969 · Concrete CMS

    Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer: Adrian Tiron from FORTBRIDGE (…

    Published 19 Nov 2021 · Fixed in 8.5.7 · NVD
  11. High 7.2

    CVE-2021-22968 · Concrete CMS

    A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the…

    Published 19 Nov 2021 · Fixed in 8.5.7 · NVD
  12. High 7.5

    CVE-2021-22967 · Concrete CMS

    In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3…

    Published 19 Nov 2021 · Fixed in 8.5.7 · NVD
  13. High 8.8

    CVE-2021-22966 · Concrete CMS

    Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved. Concrete CMS Security team CVSS scoring: 7.1…

    Published 19 Nov 2021 · Fixed in 8.5.7 · NVD
  14. High 7.5

    CVE-2021-22965 · Ivanti Connect Secure

    A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.

    Published 19 Nov 2021 · NVD
  15. High 7.5

    CVE-2021-22951 · Concrete CMS

    Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning…

    Published 19 Nov 2021 · Fixed in 8.5.7 · NVD
  16. High 7.8

    CVE-2021-3962 · ImageMagick

    A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to create a specially crafted image that leads to a use-after-free vulnerability when processed by ImageMagick. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

    Published 19 Nov 2021 · NVD
  17. Medium 5.4

    CVE-2021-3961 · Snipe-IT

    snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Published 19 Nov 2021 · Fixed in 5.3.2 · NVD
  18. Critical 9.8Actively exploited

    CVE-2021-44026 · Roundcube

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    Published 19 Nov 2021 · Fixed in 1.3.17, 1.4.12 · NVD
  19. Medium 6.1

    CVE-2021-44025 · Roundcube

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.

    Published 19 Nov 2021 · Fixed in 1.3.17, 1.4.12 · NVD
  20. Low 2.7

    CVE-2021-37939 · Kibana

    It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connectors to view limited HTTP response data on hosts accessible to the cluster.

    Published 18 Nov 2021 · Fixed in 7.15.2 · NVD
  21. Medium 4.3

    CVE-2021-37938 · Kibana

    It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Thanks to Dominic Couture for finding this vulnerability.

    Published 18 Nov 2021 · Fixed in 7.15.2 · NVD
  22. Medium

    CVE-2021-41190 · Docker Engine

    Ambiguous OCI manifest parsing

    Published 18 Nov 2021 · Fixed in 20.10.11 · Project advisories (GitHub)
  23. Medium

    GHSA-5j5w-g665-5m35 · containerd

    Ambiguous OCI manifest parsing

    Published 18 Nov 2021 · Project advisories (GitHub)
  24. High 7.5Actively exploited

    CVE-2021-41277 · Metabase

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any…

    Published 17 Nov 2021 · NVD
  25. Medium 5.4

    CVE-2021-41165 · Drupal

    CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The…

    Published 17 Nov 2021 · Fixed in 8.9.20, 9.1.14, 9.2.9 · NVD
  26. Medium 5.4

    CVE-2021-41164 · Drupal

    CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The…

    Published 17 Nov 2021 · Fixed in 8.9.20, 9.1.14, 9.2.9 · NVD
  27. Medium 6.1

    CVE-2021-43977 · SmarterMail

    SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.

    Published 17 Nov 2021 · Fixed in 100.0.7803 · NVD
  28. Critical 9.8

    CVE-2021-32234 · SmarterMail

    SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.

    Published 17 Nov 2021 · Fixed in 100.0.7803 · NVD
  29. Medium 6.5

    CVE-2021-42250 · Apache Superset

    Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

    Published 17 Nov 2021 · Fixed in 1.3.2 · NVD
  30. Low 3.8

    CVE-2021-32600 · Fortinet FortiOS

    An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may allow a local and authenticated user assigned to a specific VDOM to retrieve other VDOMs information such as the admin account list and the network interface list.

    Published 17 Nov 2021 · Fixed in 6.2.10, 6.4.7 · NVD
  31. Medium 5.4

    CVE-2021-41258 · Kirby

    Cross-site scripting (XSS) from image block content in the site frontend

    Published 16 Nov 2021 · Fixed in 3.5.8 · NVD, Project advisories (GitHub)
  32. Medium 5.4

    CVE-2021-41252 · Kirby

    Cross-site scripting (XSS) from writer field content in the site frontend

    Published 16 Nov 2021 · Fixed in 3.5.8 · NVD, Project advisories (GitHub)
  33. Medium 5.3

    CVE-2021-41271 · Discourse

    Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

    Published 15 Nov 2021 · NVD
  34. High 7.2

    CVE-2021-41244 · Grafana

    Fine-grained access control enables organization admins to create/modify/delete user roles in other organization

    Published 15 Nov 2021 · Fixed in 8.2.4 · NVD, Project advisories (GitHub)
  35. Medium 5.4

    CVE-2021-3938 · Snipe-IT

    snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Published 13 Nov 2021 · NVD
  36. Medium 4.3

    CVE-2021-3931 · Snipe-IT

    snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

    Published 13 Nov 2021 · NVD
  37. Medium 6.5

    CVE-2021-41972 · Apache Superset

    Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

    Published 12 Nov 2021 · NVD
  38. High 7.5

    CVE-2002-20001 · F5 BIG-IP

    The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a…

    Published 11 Nov 2021 · Fixed in 16.1.4, 17.1.0 · NVD
  39. Critical 9.8

    CVE-2021-33816 · Dolibarr ERP CRM

    The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

    Published 10 Nov 2021 · NVD
  40. Medium 6.1

    CVE-2021-33618 · Dolibarr ERP CRM

    Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.

    Published 10 Nov 2021 · NVD
  41. Medium 5.5

    CVE-2020-23906 · FFmpeg

    FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity.

    Published 10 Nov 2021 · NVD
  42. High 8.8

    CVE-2021-22048 · VMware vCenter Server

    The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.

    Published 10 Nov 2021 · NVD
  43. Critical 9.8

    CVE-2021-3064 · Palo Alto Networks PAN-OS

    A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than…

    Published 10 Nov 2021 · Fixed in 8.1.17 · NVD
  44. High 7.5

    CVE-2021-3063 · Palo Alto Networks PAN-OS

    An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by…

    Published 10 Nov 2021 · Fixed in 8.1.21, 10.1.3 · NVD
  45. High 8.8

    CVE-2021-3062 · Palo Alto Networks PAN-OS

    An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions…

    Published 10 Nov 2021 · Fixed in 9.0.14, 9.1.11, 10.0.8 · NVD
  46. High 7.2

    CVE-2021-3061 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS…

    Published 10 Nov 2021 · Fixed in 10.0.8, 10.1.3 · NVD
  47. High 8.1

    CVE-2021-3060 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1…

    Published 10 Nov 2021 · Fixed in 10.0.8, 10.1.3 · NVD
  48. High 8.1

    CVE-2021-3059 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier…

    Published 10 Nov 2021 · Fixed in 10.0.8, 10.1.3 · NVD
  49. High 7.2

    CVE-2021-3058 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2;…

    Published 10 Nov 2021 · Fixed in 10.0.8, 10.1.3 · NVD
  50. High 8.8

    CVE-2021-3056 · Palo Alto Networks PAN-OS

    A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier…

    Published 10 Nov 2021 · Fixed in 8.1.20, 9.0.14, 9.1.9 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.