UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,085
Published in 7 days
657
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,085 vulnerabilities
  1. Critical 9.1

    CVE-2021-21689 · Jenkins

    FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  2. High 7.5

    CVE-2021-21688 · Jenkins

    The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  3. Critical 9.1

    CVE-2021-21687 · Jenkins

    Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  4. High 8.1

    CVE-2021-21686 · Jenkins

    File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  5. Critical 9.1

    CVE-2021-21685 · Jenkins

    Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.

    Published 4 Nov 2021 · Fixed in 2.303.3, 2.319 · NVD
  6. Medium 4.8

    CVE-2021-43032 · XenForo

    In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.

    Published 3 Nov 2021 · NVD
  7. Medium 6.1

    CVE-2020-23126 · Chamilo LMS

    Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.

    Published 3 Nov 2021 · NVD
  8. Critical 9.8

    CVE-2021-43082 · Apache Traffic Server

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.

    Published 3 Nov 2021 · NVD
  9. High 7.5

    CVE-2021-41585 · Apache Traffic Server

    Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0.

    Published 3 Nov 2021 · NVD
  10. High 8.1

    CVE-2021-38161 · Apache Traffic Server

    Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.

    Published 3 Nov 2021 · NVD
  11. High 7.5

    CVE-2021-37149 · Apache Traffic Server

    Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

    Published 3 Nov 2021 · NVD
  12. High 7.5

    CVE-2021-37148 · Apache Traffic Server

    Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1.

    Published 3 Nov 2021 · NVD
  13. High 7.5

    CVE-2021-37147 · Apache Traffic Server

    Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

    Published 3 Nov 2021 · NVD
  14. Medium 6.1

    CVE-2021-41174 · Grafana

    XSS vulnerability allowing arbitrary JavaScript execution

    Published 3 Nov 2021 · Fixed in 8.2.3 · NVD, Project advisories (GitHub)
  15. High 7.5

    CVE-2021-41312 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors endpoint. The affected versions are before version 8.19.1.

    Published 3 Nov 2021 · Fixed in 8.19.1 · NVD
  16. High 7.5

    CVE-2021-36187 · Fortinet FortiWeb

    A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests

    Published 2 Nov 2021 · NVD
  17. Critical 9.8

    CVE-2021-36186 · Fortinet FortiWeb

    A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests

    Published 2 Nov 2021 · NVD
  18. Medium 6.5

    CVE-2021-41019 · Fortinet FortiOS

    An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of sensitive information, such as AD credentials.

    Published 2 Nov 2021 · NVD
  19. Medium 4.3

    CVE-2021-42568 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.

    Published 2 Nov 2021 · NVD
  20. Medium 4.3

    CVE-2021-41313 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint. The affected versions are before version 8.20.7.

    Published 1 Nov 2021 · Fixed in 8.20.7 · NVD
  21. Medium

    CVE-2021-42574 · Rust

    rustc and bidirectional-override codepoints in source code

    Published 1 Nov 2021 · Fixed in 1.56.1 · Project advisories (GitHub)
  22. High 7.2

    CVE-2021-43281 · MyBB

    ACP Settings management RCE

    Published 30 Oct 2021 · Fixed in 1.8.29 · NVD, Project advisories (GitHub)
  23. High 7.1

    CVE-2021-25742 · Ingress NGINX Controller

    A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

    Published 29 Oct 2021 · Fixed in 0.49.1 · NVD
  24. Medium 5.4

    CVE-2021-3904 · Grav

    grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Published 27 Oct 2021 · Fixed in 1.7.24 · NVD
  25. Medium 5.3

    CVE-2021-25219 · BIND 9

    In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently…

    Published 27 Oct 2021 · Fixed in 9.11.36, 9.16.22, 9.17.19 · NVD
  26. Medium 6.5

    CVE-2021-40125 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. This vulnerability is due to improper control of a resource. An attacker with the ability to spoof a…

    Published 27 Oct 2021 · Fixed in 9.14.3.9, 9.15.1.17, 9.16.2 · NVD
  27. High 7.5

    CVE-2021-40118 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious…

    Published 27 Oct 2021 · Fixed in 9.14.3.9, 9.15.1.17, 9.16.2.3 · NVD
  28. High 7.5

    CVE-2021-40117 · Cisco ASA and Firepower Threat Defense

    A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incoming SSL/TLS packets are not properly processed. An attacker could exploit this vulnerability by…

    Published 27 Oct 2021 · Fixed in 9.14.3.9, 9.15.1.17, 9.16.2.3 · NVD
  29. Medium 5.3

    CVE-2021-34794 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due to ineffective access control. An attacker could exploit this vulnerability by sending an SNMPv3…

    Published 27 Oct 2021 · Fixed in 9.14.2.4, 9.15.1.7 · NVD
  30. High 8.6

    CVE-2021-34793 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is…

    Published 27 Oct 2021 · Fixed in 9.14.3.9, 9.15.1.17, 9.16.2.3 · NVD
  31. High 7.5

    CVE-2021-34792 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management when connection rates are high. An attacker could exploit this vulnerability by opening…

    Published 27 Oct 2021 · Fixed in 9.14.3.9, 9.15.1.17, 9.16.2.3 · NVD
  32. Medium 5.3

    CVE-2021-34791 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities,…

    Published 27 Oct 2021 · Fixed in 9.12.4.18, 9.14.2.15, 9.15.1.15 · NVD
  33. Medium 5.3

    CVE-2021-34790 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities,…

    Published 27 Oct 2021 · Fixed in 9.12.4.29, 9.14.2.15, 9.15.1.15 · NVD
  34. Medium 5.3

    CVE-2021-34787 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper handling of network requests by affected devices configured to use object group search. An attacker…

    Published 27 Oct 2021 · Fixed in 9.14.3.1, 9.15.1.17, 9.16.1.28 · NVD
  35. High 7.5

    CVE-2021-34783 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the software-based SSL/TLS message handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient validation of SSL/TLS messages when the device performs…

    Published 27 Oct 2021 · Fixed in 9.14.3.9, 9.15.1.17, 9.16.2 · NVD
  36. Medium 5.4

    CVE-2021-41866 · MyBB

    ACP Template Name XSS

    Published 26 Oct 2021 · Fixed in 1.8.28 · NVD, Project advisories (GitHub)
  37. Medium 5.4

    CVE-2021-41188 · Shopware

    Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The…

    Published 26 Oct 2021 · Fixed in 5.7.6 · NVD
  38. Medium 6.1

    CVE-2021-41183 · Drupal, Oracle WebLogic Server, org.webjars.npm:jquery-ui and 3 more

    XSS in `*Text` options of the Datepicker widget in jquery-ui

    Published 26 Oct 2021 · Fixed in 7.86, 9.2.11, 9.3.3 · NVD, OSV.dev and GitHub
  39. Medium 6.1

    CVE-2021-41184 · Drupal, Oracle WebLogic Server, org.webjars.npm:jquery-ui and 3 more

    XSS in the `of` option of the `.position()` util in jquery-ui

    Published 26 Oct 2021 · Fixed in 7.86, 9.2.11, 9.3.3 · NVD, OSV.dev and GitHub
  40. Medium 6.1

    CVE-2021-41182 · Drupal, Oracle WebLogic Server, org.webjars.npm:jquery-ui and 3 more

    XSS in the `altField` option of the Datepicker widget in jquery-ui

    Published 26 Oct 2021 · Fixed in 1.13.0, 7.0.0, 7.86 · NVD, OSV.dev and GitHub
  41. High 7.2

    CVE-2021-40345 · Nagios XI

    An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.

    Published 26 Oct 2021 · NVD
  42. High 7.2

    CVE-2021-40344 · Nagios XI

    An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.

    Published 26 Oct 2021 · NVD
  43. High 7.8

    CVE-2021-40343 · Nagios XI

    An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the root user.

    Published 26 Oct 2021 · NVD
  44. Medium 5.4

    CVE-2020-5669 · Movable Type

    Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.

    Published 26 Oct 2021 · NVD
  45. Critical 9.8

    CVE-2021-20837 · Movable Type

    Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute…

    Published 26 Oct 2021 · NVD
  46. Medium 6.5

    CVE-2021-41308 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.

    Published 26 Oct 2021 · Fixed in 8.6.0, 8.13.12, 8.20.1 · NVD
  47. High 7.5

    CVE-2021-41307 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.

    Published 26 Oct 2021 · Fixed in 8.13.12, 8.20.0 · NVD
  48. High 7.5

    CVE-2021-41306 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.

    Published 26 Oct 2021 · Fixed in 8.13.12, 8.20.0 · NVD
  49. High 7.5

    CVE-2021-41305 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version 8.13.12..

    Published 26 Oct 2021 · Fixed in 8.13.12 · NVD
  50. Medium 6.1

    CVE-2021-41304 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2.

    Published 26 Oct 2021 · Fixed in 8.13.12, 8.20.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.