UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,102
Published in 7 days
674
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,102 vulnerabilities
  1. Medium 5.4

    CVE-2021-40711 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a stored XSS vulnerability when creating Content Fragments. An authenticated attacker can send a malformed POST request to achieve arbitrary code execution. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 27 Sept 2021 · NVD
  2. Medium 6.4

    CVE-2021-40109 · Concrete CMS

    A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the redirected-to server. Files of disallowed types can be uploaded.

    Published 27 Sept 2021 · Fixed in 8.5.6 · NVD
  3. High 8.8

    CVE-2021-40108 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save endpoint.

    Published 27 Sept 2021 · Fixed in 8.5.6 · NVD
  4. Medium 5.3

    CVE-2021-3818 · Grav

    grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking

    Published 27 Sept 2021 · Fixed in 1.7.22 · NVD
  5. Medium 6.1

    CVE-2021-40106 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field.

    Published 27 Sept 2021 · NVD
  6. Medium 6.1

    CVE-2021-40105 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments.

    Published 27 Sept 2021 · NVD
  7. High 7.5

    CVE-2021-40104 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass.

    Published 27 Sept 2021 · NVD
  8. High 7.5

    CVE-2021-40103 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF.

    Published 27 Sept 2021 · NVD
  9. Critical 9.8

    CVE-2021-40098 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regular expression.

    Published 27 Sept 2021 · NVD
  10. High 8.8

    CVE-2021-40097 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution via uploaded PHP code, related to the bFilename parameter.

    Published 27 Sept 2021 · NVD
  11. Medium 6.1

    CVE-2021-23054 · F5 BIG-IP

    On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 27 Sept 2021 · Fixed in 14.1.4.4, 15.1.4, 16.0.1 · NVD
  12. High 7.0

    CVE-2021-41617 · OpenSSH

    sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a…

    Published 26 Sept 2021 · Fixed in 8.8 · NVD
  13. Critical 9.1

    CVE-2021-40102 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated with the __wakeup magic method).

    Published 24 Sept 2021 · NVD
  14. Medium 5.4

    CVE-2021-40100 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text.

    Published 24 Sept 2021 · NVD
  15. High 7.2

    CVE-2021-40099 · Concrete CMS

    An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution.

    Published 24 Sept 2021 · NVD
  16. Medium 5.3

    CVE-2020-24327 · Discourse

    Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.

    Published 23 Sept 2021 · NVD
  17. Medium 5.4

    CVE-2021-22953 · Concrete CMS

    A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"

    Published 23 Sept 2021 · NVD
  18. Medium 6.5

    CVE-2021-22950 · Concrete CMS

    Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"

    Published 23 Sept 2021 · Fixed in 8.5.6 · NVD
  19. Medium 5.4

    CVE-2021-22949 · Concrete CMS

    A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security CMS Research Team"

    Published 23 Sept 2021 · NVD
  20. Critical 9.1

    CVE-2021-22945 · curl, MySQL

    When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

    Published 23 Sept 2021 · NVD
  21. Medium 5.5

    CVE-2021-22020 · VMware vCenter Server

    The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an attacker to create a denial-of-service condition on vCenter Server.

    Published 23 Sept 2021 · NVD
  22. High 7.5

    CVE-2021-22019 · VMware vCenter Server

    The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.

    Published 23 Sept 2021 · NVD
  23. Medium 6.5

    CVE-2021-22018 · VMware vCenter Server

    The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.

    Published 23 Sept 2021 · NVD
  24. Medium 5.3Actively exploited

    CVE-2021-22017 · VMware vCenter Server

    Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

    Published 23 Sept 2021 · NVD
  25. Medium 6.1

    CVE-2021-22016 · VMware vCenter Server

    The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.

    Published 23 Sept 2021 · NVD
  26. High 7.8

    CVE-2021-22015 · VMware vCenter Server

    The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.

    Published 23 Sept 2021 · NVD
  27. High 7.2

    CVE-2021-22014 · VMware vCenter Server

    The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.

    Published 23 Sept 2021 · NVD
  28. High 7.5

    CVE-2021-22013 · VMware vCenter Server

    The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

    Published 23 Sept 2021 · NVD
  29. High 7.5

    CVE-2021-22012 · VMware vCenter Server

    The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

    Published 23 Sept 2021 · NVD
  30. Medium 5.3

    CVE-2021-22011 · VMware vCenter Server

    vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.

    Published 23 Sept 2021 · NVD
  31. High 7.5

    CVE-2021-22010 · VMware vCenter Server

    The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD service.

    Published 23 Sept 2021 · NVD
  32. High 7.5

    CVE-2021-22009 · VMware vCenter Server

    The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due to excessive memory consumption by VAPI service.

    Published 23 Sept 2021 · NVD
  33. High 7.5

    CVE-2021-22008 · VMware vCenter Server

    The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information.

    Published 23 Sept 2021 · NVD
  34. Medium 5.5

    CVE-2021-22007 · VMware vCenter Server

    The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information.

    Published 23 Sept 2021 · NVD
  35. High 7.5

    CVE-2021-22006 · VMware vCenter Server

    The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints.

    Published 23 Sept 2021 · NVD
  36. Critical 9.8Actively exploited

    CVE-2021-22005 · VMware vCenter Server

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

    Published 23 Sept 2021 · NVD
  37. Medium 6.5

    CVE-2021-21993 · VMware vCenter Server

    The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosure.

    Published 23 Sept 2021 · NVD
  38. Medium 6.5

    CVE-2021-21992 · VMware vCenter Server

    The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the vCenter Server vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash) may exploit this issue to create a denial-of-service condition on the vCenter Server host.

    Published 22 Sept 2021 · NVD
  39. High 7.8

    CVE-2021-21991 · VMware vCenter Server

    The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).

    Published 22 Sept 2021 · NVD
  40. Medium 6.1

    CVE-2021-37860 · Mattermost

    Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.

    Published 22 Sept 2021 · NVD
  41. Medium 5.9

    CVE-2021-38153 · Apache Kafka

    Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2,…

    Published 22 Sept 2021 · Fixed in 2.6.3, 2.7.2 · NVD
  42. Unrated

    WPV-2d0c2ee5a99c · WooCommerce

    Vulnerability in WooCommerce

    Published 22 Sept 2021 · Fixed in 5.7.0 · WPVulnerability
  43. High 7.5

    CVE-2021-41082 · Discourse

    Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The…

    Published 20 Sept 2021 · Fixed in 2021-09-14 · NVD
  44. High 8.1

    CVE-2021-25741 · Kubernetes

    A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

    Published 20 Sept 2021 · NVD
  45. Medium 4.1

    CVE-2020-8561 · Kubernetes

    A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

    Published 20 Sept 2021 · NVD
  46. High 8.8

    CVE-2021-38094 · FFmpeg

    Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

    Published 20 Sept 2021 · NVD
  47. High 8.8

    CVE-2021-38093 · FFmpeg

    Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

    Published 20 Sept 2021 · NVD
  48. High 8.8

    CVE-2021-38092 · FFmpeg

    Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

    Published 20 Sept 2021 · NVD
  49. High 8.8

    CVE-2021-38091 · FFmpeg

    Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

    Published 20 Sept 2021 · NVD
  50. High 8.8

    CVE-2021-38090 · FFmpeg

    Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

    Published 20 Sept 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.