Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,115
- Published in 7 days
- 687
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,115 vulnerabilities- Medium 6.5
CVE-2021-21992 · VMware vCenter Server
The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the vCenter Server vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash) may exploit this issue to create a denial-of-service condition on the vCenter Server host.
Published 22 Sept 2021 · NVD - High 7.8
CVE-2021-21991 · VMware vCenter Server
The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).
Published 22 Sept 2021 · NVD - Medium 6.1
CVE-2021-37860 · Mattermost
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
Published 22 Sept 2021 · NVD - Medium 5.9
CVE-2021-38153 · Apache Kafka
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2,…
Published 22 Sept 2021 · Fixed in 2.6.3, 2.7.2 · NVD - Unrated
WPV-2d0c2ee5a99c · WooCommerce
Vulnerability in WooCommerce
Published 22 Sept 2021 · Fixed in 5.7.0 · WPVulnerability - High 7.5
CVE-2021-41082 · Discourse
Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The…
Published 20 Sept 2021 · Fixed in 2021-09-14 · NVD - High 8.1
CVE-2021-25741 · Kubernetes
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
Published 20 Sept 2021 · NVD - Medium 4.1
CVE-2020-8561 · Kubernetes
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2021-38094 · FFmpeg
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2021-38093 · FFmpeg
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2021-38092 · FFmpeg
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2021-38091 · FFmpeg
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2021-38090 · FFmpeg
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Published 20 Sept 2021 · NVD - Medium 6.5
CVE-2020-20902 · FFmpeg
A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R'(0), that could result in disclosure of information.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2020-20898 · FFmpeg
Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2020-20896 · FFmpeg
An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a Null pointer dereference.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2020-20892 · FFmpeg
An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a division by zero.
Published 20 Sept 2021 · NVD - High 8.8
CVE-2020-20891 · FFmpeg
Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
Published 20 Sept 2021 · NVD - High 7.5
CVE-2021-40690 · Oracle WebLogic Server
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Published 19 Sept 2021 · NVD - Medium 5.8
GHSA-wfrj-qqc2-83cm · Ghost
Remote command injection when using sendmail email transport
Published 17 Sept 2021 · Fixed in 4.15.0 · Project advisories (GitHub) - Medium 5.3
CVE-2021-29842 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
Published 16 Sept 2021 · NVD - High 7.5
CVE-2021-41079 · Apache Tomcat
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Published 16 Sept 2021 · Fixed in 8.5.64, 9.0.44 · NVD - Critical 9.0Actively exploited
CVE-2021-40438 · Apache HTTP Server
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Published 16 Sept 2021 · NVD - Critical 9.8
CVE-2021-39275 · Apache HTTP Server
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
Published 16 Sept 2021 · Fixed in 2.4.49 · NVD - High 7.5
CVE-2021-36160 · Apache HTTP Server
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).
Published 16 Sept 2021 · Fixed in 2.4.49 · NVD - High 7.5
CVE-2021-34798 · Apache HTTP Server
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
Published 16 Sept 2021 · NVD - High 7.2
CVE-2021-39128 · Jira
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1.
Published 16 Sept 2021 · Fixed in 8.13.12, 8.19.1 · NVD - Medium 5.3
CVE-2016-20012 · OpenSSH
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product
Published 15 Sept 2021 · NVD - High 8.8
CVE-2021-39213 · GLPI
GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as a workaround.
Published 15 Sept 2021 · Fixed in 9.5.6 · NVD - Medium 5.3
CVE-2021-39211 · GLPI
GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.
Published 15 Sept 2021 · Fixed in 9.5.6 · NVD - Medium 6.5
CVE-2021-39210 · GLPI
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue is fixed in version 9.5.6. As a workaround, one may avoid using the "remember me" feature.
Published 15 Sept 2021 · Fixed in 9.5.6 · NVD - High 8.8
CVE-2021-39209 · GLPI
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on GLPI. This issue is fixed in version 9.5.6. There are no workarounds aside from upgrading.
Published 15 Sept 2021 · Fixed in 9.5.6 · NVD - Medium 5.4
CVE-2021-38156 · Nagios XI
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
Published 15 Sept 2021 · Fixed in 5.8.6 · NVD - Critical 9.8
CVE-2021-3797 · Hestia Control Panel
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
Published 15 Sept 2021 · NVD - Medium 6.5
CVE-2021-22147 · Elasticsearch
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
Published 15 Sept 2021 · Fixed in 7.14.0 · NVD - Medium 5.3
CVE-2021-39189 · Pimcore
Observable Response Discrepancy in Lost Password Service
Published 15 Sept 2021 · Fixed in 10.1.3 · NVD, Project advisories (GitHub) - Medium 6.1
CVE-2021-23027 · F5 BIG-IP
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · NVD - High 8.8
CVE-2021-23026 · F5 BIG-IP
BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · NVD - High 8.8
CVE-2021-23025 · F5 BIG-IP
On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · Fixed in 13.1.3.5, 14.1.3.1, 15.1.0.5 · NVD - High 7.5
CVE-2021-23039 · F5 BIG-IP
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is configured on a BIG-IP system, undisclosed requests from an authorized remote (IPSec) peer, which already has a negotiated Security Association, can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of…
Published 14 Sept 2021 · Fixed in 14.1.2.8, 15.1.3, 16.0.1.2 · NVD - Critical 9.0
CVE-2021-23038 · F5 BIG-IP
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of…
Published 14 Sept 2021 · Fixed in 14.1.4.2, 15.1.3.1, 16.0.1.2 · NVD - Critical 9.6
CVE-2021-23037 · F5 BIG-IP
On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · NVD - High 7.5
CVE-2021-23035 · F5 BIG-IP
On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · NVD - High 7.5
CVE-2021-23034 · F5 BIG-IP
On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · Fixed in 15.1.3.1, 16.1.0 · NVD - High 7.5
CVE-2021-23045 · F5 BIG-IP
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP profile with multiple paths is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · Fixed in 14.1.4.3, 15.1.3.1, 16.0.1.2 · NVD - High 7.5
CVE-2021-23044 · F5 BIG-IP
On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the Intel QuickAssist Technology (QAT) compression driver is used on affected BIG-IP hardware and BIG-IP Virtual Edition (VE) platforms, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software…
Published 14 Sept 2021 · Fixed in 14.1.4.2, 15.1.3.1, 16.1.0 · NVD - Medium 4.9
CVE-2021-23046 · F5 BIG-IP
On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configuration (AGC), secure properties are logged in restnoded logs. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · Fixed in 16.1.0 · NVD - Medium 6.5
CVE-2021-23043 · F5 BIG-IP
On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · NVD - High 7.5
CVE-2021-23042 · F5 BIG-IP
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a virtual server, undisclosed requests can cause a significant increase in system resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 14 Sept 2021 · Fixed in 14.1.4, 15.1.3, 16.0.1.2 · NVD - Medium 5.3
CVE-2021-23047 · F5 BIG-IP
On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APM performs Online Certificate Status Protocol (OCSP) verification of a certificate that contains Authority Information Access (AIA), undisclosed requests may cause an increase in memory use. Note: Software versions which have reached End of Technical Support…
Published 14 Sept 2021 · Fixed in 13.1.4, 14.1.4.3, 15.1.3.1 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.