UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,078
Published in 7 days
650
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,078 vulnerabilities
  1. High 7.2

    CVE-2021-3058 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2;…

    Published 10 Nov 2021 · Fixed in 10.0.8, 10.1.3 · NVD
  2. High 8.8

    CVE-2021-3056 · Palo Alto Networks PAN-OS

    A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier…

    Published 10 Nov 2021 · Fixed in 8.1.20, 9.0.14, 9.1.9 · NVD
  3. High 8.8Actively exploited

    CVE-2021-42321 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 10 Nov 2021 · NVD
  4. Medium 6.5

    CVE-2021-42305 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 10 Nov 2021 · NVD
  5. Medium 6.5

    CVE-2021-41349 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 10 Nov 2021 · NVD
  6. Medium 5.3

    CVE-2021-43201 · TeamCity

    In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.

    Published 9 Nov 2021 · Fixed in 2021.1.3 · NVD
  7. Critical 9.8

    CVE-2021-43200 · TeamCity

    In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.

    Published 9 Nov 2021 · Fixed in 2021.2 · NVD
  8. Medium 5.3

    CVE-2021-43199 · TeamCity

    In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.

    Published 9 Nov 2021 · Fixed in 2021.1.2. · NVD
  9. Medium 5.4

    CVE-2021-43198 · TeamCity

    In JetBrains TeamCity before 2021.1.2, stored XSS is possible.

    Published 9 Nov 2021 · Fixed in 2021.1.2 · NVD
  10. Medium 6.1

    CVE-2021-43197 · TeamCity

    In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.

    Published 9 Nov 2021 · Fixed in 2021.1.2 · NVD
  11. High 7.5

    CVE-2021-43196 · TeamCity

    In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.

    Published 9 Nov 2021 · Fixed in 2021.1 · NVD
  12. Medium 5.3

    CVE-2021-43195 · TeamCity

    In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.

    Published 9 Nov 2021 · Fixed in 2021.1.2 · NVD
  13. Medium 5.3

    CVE-2021-43194 · TeamCity

    In JetBrains TeamCity before 2021.1.2, user enumeration was possible.

    Published 9 Nov 2021 · Fixed in 2021.1.2 · NVD
  14. Critical 9.8

    CVE-2021-43193 · TeamCity

    In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.

    Published 9 Nov 2021 · Fixed in 2021.1.2 · NVD
  15. Medium 6.1

    CVE-2021-42770 · OPNsense

    A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.

    Published 8 Nov 2021 · Fixed in 21.7.4 · NVD
  16. High 7.5

    CVE-2021-3924 · Grav

    grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    Published 5 Nov 2021 · NVD
  17. Critical 9.8Actively exploited

    CVE-2021-42237 · Sitecore Experience Platform

    Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

    Published 5 Nov 2021 · NVD
  18. Medium 6.7

    CVE-2021-39913 · GitLab

    Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  19. Medium 5.3

    CVE-2021-39912 · GitLab

    A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustion.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  20. Medium 4.3

    CVE-2021-39911 · GitLab

    An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  21. Medium 5.3

    CVE-2021-39909 · GitLab

    Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  22. Medium 5.3

    CVE-2021-39907 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  23. Medium 6.1

    CVE-2021-39906 · GitLab

    Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  24. Medium 4.3

    CVE-2021-39905 · GitLab

    An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with

    Published 5 Nov 2021 · Fixed in 14.2.6 · NVD
  25. Medium 4.3

    CVE-2021-39904 · GitLab

    An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  26. Low 2.7

    CVE-2021-39901 · GitLab

    In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  27. Medium 5.3

    CVE-2021-39898 · GitLab

    In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.

    Published 5 Nov 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  28. Medium 5.3

    CVE-2021-39897 · GitLab

    Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred

    Published 5 Nov 2021 · Fixed in 12.9.8, 12.10.7 · NVD
  29. Medium 4.5

    CVE-2021-39895 · GitLab

    In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.

    Published 5 Nov 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  30. Medium 5.4

    CVE-2021-22260 · GitLab

    A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf

    Published 5 Nov 2021 · Fixed in 14.0.9, 14.1.4, 14.2.2 · NVD
  31. Medium 4.3

    CVE-2021-39914 · GitLab

    A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user

    Published 4 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  32. Medium 6.5

    CVE-2021-39903 · GitLab

    In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.

    Published 4 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  33. Medium 4.3

    CVE-2021-39902 · GitLab

    Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.

    Published 4 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  34. High 7.5

    CVE-2021-43396 · GNU C Library

    In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf,…

    Published 4 Nov 2021 · NVD
  35. Medium 4.3

    CVE-2021-43293 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).

    Published 4 Nov 2021 · NVD
  36. Critical 9.1

    CVE-2021-21697 · Jenkins

    Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

    Published 4 Nov 2021 · NVD
  37. Critical 9.8

    CVE-2021-21696 · Jenkins

    Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process.

    Published 4 Nov 2021 · NVD
  38. High 8.8

    CVE-2021-21695 · Jenkins

    FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  39. Critical 9.8

    CVE-2021-21694 · Jenkins

    FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  40. Critical 9.8

    CVE-2021-21693 · Jenkins

    When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  41. Critical 9.8

    CVE-2021-21692 · Jenkins

    FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  42. Critical 9.8

    CVE-2021-21691 · Jenkins

    Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  43. Critical 9.8

    CVE-2021-21690 · Jenkins

    Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  44. Critical 9.1

    CVE-2021-21689 · Jenkins

    FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  45. High 7.5

    CVE-2021-21688 · Jenkins

    The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  46. Critical 9.1

    CVE-2021-21687 · Jenkins

    Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  47. High 8.1

    CVE-2021-21686 · Jenkins

    File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  48. Critical 9.1

    CVE-2021-21685 · Jenkins

    Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  49. Medium 4.8

    CVE-2021-43032 · XenForo

    In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.

    Published 3 Nov 2021 · NVD
  50. Medium 6.1

    CVE-2020-23126 · Chamilo LMS

    Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.

    Published 3 Nov 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.