UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,102
Published in 7 days
674
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,102 vulnerabilities
  1. Medium 6.5

    CVE-2021-39872 · GitLab

    In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  2. Medium 6.5

    CVE-2021-39869 · GitLab

    In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  3. High 8.1

    CVE-2021-39867 · GitLab

    In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  4. Medium 5.4

    CVE-2021-39866 · GitLab

    A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  5. Medium 5.4

    CVE-2021-39887 · GitLab

    A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf.

    Published 5 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  6. Medium 6.5

    CVE-2021-37223 · Nagios XI

    Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.

    Published 5 Oct 2021 · NVD
  7. Medium 5.3

    CVE-2021-41114 · TYPO3

    HTTP Host Header Injection in Request Handling

    Published 5 Oct 2021 · Fixed in 11.5.0 · NVD, Project advisories (GitHub)
  8. High 8.8

    CVE-2021-41113 · TYPO3

    Cross-Site-Request-Forgery in Backend URI Handling

    Published 5 Oct 2021 · Fixed in 11.5.0 · NVD, Project advisories (GitHub)
  9. Critical 9.8Actively exploited

    CVE-2021-41773 · Apache HTTP Server

    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these…

    Published 5 Oct 2021 · NVD
  10. High 7.5

    CVE-2021-41524 · Apache HTTP Server

    While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

    Published 5 Oct 2021 · NVD
  11. Medium 5.3

    CVE-2021-25118 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Exposure of Sensitive Information to an Unauthorized Actor

    Published 5 Oct 2021 · Fixed in 17.3 · NVD, WPVulnerability
  12. Medium 6.3

    CVE-2021-41089 · Docker Engine

    `docker cp` allows unexpected chmod of host files

    Published 4 Oct 2021 · Fixed in 20.10.9 · NVD, Project advisories (GitHub)
  13. Medium 6.3

    CVE-2021-41091 · Docker Engine

    Insufficiently restricted permissions on data directory

    Published 4 Oct 2021 · Fixed in 20.10.9 · NVD, Project advisories (GitHub)
  14. High 7.5

    CVE-2021-41099 · Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  15. High 8.8

    CVE-2021-32762 · Redis

    Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  16. High 7.5

    CVE-2021-32687 · Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  17. High 7.5

    CVE-2021-32675 · Redis

    Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  18. Medium 4.3

    CVE-2021-32672 · Redis

    Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  19. High 7.5

    CVE-2021-32628 · Redis

    Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  20. High 7.5

    CVE-2021-32627 · Redis

    Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  21. High 8.8

    CVE-2021-32626 · Redis

    Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from…

    Published 4 Oct 2021 · Fixed in 5.0.14, 6.0.16, 6.2.6 · NVD
  22. Low 2.7

    CVE-2021-39900 · GitLab

    Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  23. Medium 4.2

    CVE-2021-39899 · GitLab

    In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from…

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  24. Low 3.8

    CVE-2021-39896 · GitLab

    In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  25. Medium 5.4

    CVE-2021-39885 · GitLab

    A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious approval rule names

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  26. Medium 4.3

    CVE-2021-39883 · GitLab

    Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  27. Low 3.5

    CVE-2021-39879 · GitLab

    Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication

    Published 4 Oct 2021 · Fixed in 14.1.7 · NVD
  28. Medium 5.5

    CVE-2021-39877 · GitLab

    A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  29. Medium 4.3

    CVE-2021-39874 · GitLab

    In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  30. Medium 4.3

    CVE-2021-39873 · GitLab

    In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  31. Medium 4.3

    CVE-2021-39871 · GitLab

    In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  32. Medium 4.3

    CVE-2021-39868 · GitLab

    In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export.

    Published 4 Oct 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  33. Medium 6.5

    CVE-2021-22259 · GitLab

    A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.

    Published 4 Oct 2021 · Fixed in 14.1.7 · NVD
  34. High 7.8

    CVE-2021-41103 · containerd

    Insufficiently restricted permissions on container root and plugin directories

    Published 4 Oct 2021 · Fixed in 1.4.11, 1.5.7 · NVD, Project advisories (GitHub)
  35. Medium 6.5

    CVE-2021-21706 · PHP

    In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

    Published 4 Oct 2021 · Fixed in 7.3.31, 7.4.24, 8.0.11 · NVD
  36. Medium 5.3

    CVE-2021-21705 · PHP

    In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a…

    Published 4 Oct 2021 · Fixed in 7.3.29, 7.4.21, 8.0.8 · NVD
  37. Medium 5.9

    CVE-2021-21704 · PHP

    In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially…

    Published 4 Oct 2021 · Fixed in 7.3.29, 7.4.21, 8.0.8 · NVD
  38. High 7.5

    CVE-2021-41611 · Squid

    SQUID-2021:6 Improper Certificate Validation of TLS server certificates

    Published 4 Oct 2021 · Fixed in 5.2 · NVD, Project advisories (GitHub)
  39. High 7.5

    CVE-2021-41109 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as…

    Published 30 Sept 2021 · Fixed in 4.10.4 · NVD
  40. High 8.8

    CVE-2021-41824 · Craft CMS

    Craft CMS before 3.7.14 allows CSV injection.

    Published 30 Sept 2021 · Fixed in 3.7.14 · NVD
  41. Medium 5.9

    CVE-2021-22947 · curl, MySQL

    When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were…

    Published 29 Sept 2021 · Fixed in 7.79.0 · NVD
  42. High 7.5

    CVE-2021-22946 · curl, MySQL

    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl…

    Published 29 Sept 2021 · Fixed in 7.79.0 · NVD
  43. Critical 9.8

    CVE-2021-36366 · Nagios XI

    Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.

    Published 28 Sept 2021 · Fixed in 5.8.5 · NVD
  44. Critical 9.8

    CVE-2021-36365 · Nagios XI

    Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.

    Published 28 Sept 2021 · Fixed in 5.8.5 · NVD
  45. Critical 9.8

    CVE-2021-36364 · Nagios XI

    Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.

    Published 28 Sept 2021 · Fixed in 5.8.5 · NVD
  46. Critical 9.8

    CVE-2021-36363 · Nagios XI

    Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.

    Published 28 Sept 2021 · Fixed in 5.8.5 · NVD
  47. Medium 6.1

    CVE-2021-41095 · Discourse

    Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, versions 2.8.0.beta6 and earlier of the `beta` branch, and versions 2.8.0.beta6 and earlier of the `tests-passed` branch. Rendering of some error messages that contain user input can be susceptible to XSS attacks. This vulnerability only…

    Published 27 Sept 2021 · NVD
  48. Medium 6.1

    CVE-2021-40714 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser

    Published 27 Sept 2021 · NVD
  49. Medium 5.9

    CVE-2021-40713 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an attacker can achieve a man in the middle when the cold server establishes a new certificate, they would be able to harvest sensitive information.

    Published 27 Sept 2021 · NVD
  50. Medium 6.5

    CVE-2021-40712 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attacker can send a malformed POST request to achieve server-side denial of service.

    Published 27 Sept 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.