UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,115
Published in 7 days
687
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,115 vulnerabilities
  1. Medium 6.1

    CVE-2021-23041 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End…

    Published 14 Sept 2021 · Fixed in 14.1.4.2, 15.1.3, 16.0.1.2 · NVD
  2. Medium 6.1

    CVE-2021-23052 · F5 BIG-IP

    On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious user to build an open redirect URI. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 14 Sept 2021 · Fixed in 14.1.4.4 · NVD
  3. High 7.5

    CVE-2021-23051 · F5 BIG-IP

    On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP on Amazon Web Services (AWS) systems, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This is due to an incomplete fix for CVE-2020-5862. Note: Software versions which have reached End of Technical Support (EoTS) are…

    Published 14 Sept 2021 · Fixed in 15.1.3.1 · NVD
  4. High 7.5

    CVE-2021-23049 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an out-of-memory condition and a denial-of-service (DoS). Note: Software versions which have reached End of Technical Support (EoTS) are not…

    Published 14 Sept 2021 · Fixed in 15.1.3, 16.0.1.2 · NVD
  5. High 7.5

    CVE-2021-23048 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol (GTP) iRules commands or a GTP profile is configured on a virtual server, undisclosed GTP messages can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of…

    Published 14 Sept 2021 · Fixed in 14.1.4.3, 15.1.3.1, 16.0.1.2 · NVD
  6. Medium 5.3

    CVE-2021-39125 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability in the password reset page. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.

    Published 14 Sept 2021 · Fixed in 8.5.10, 8.13.1 · NVD
  7. Medium 4.3

    CVE-2021-39124 · Jira

    The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user into retrying a request to bypass CSRF protection and replay a crafted request.

    Published 14 Sept 2021 · Fixed in 8.16.0 · NVD
  8. High 7.5

    CVE-2021-39123 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the /rest/gadget/1.0/createdVsResolved/generate endpoint. The affected versions are before version 8.16.0.

    Published 14 Sept 2021 · Fixed in 8.16.0 · NVD
  9. Medium 5.3

    CVE-2021-39118 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the /rest/api/1.0/render endpoint. The affected versions are before version 8.19.0.

    Published 14 Sept 2021 · Fixed in 8.19.0 · NVD
  10. Medium 5.3

    CVE-2019-20101 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability in the /rest/whitelist/<version>/check endpoint. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

    Published 14 Sept 2021 · Fixed in 8.13.3 · NVD
  11. Low 3.6

    CVE-2021-39212 · ImageMagick

    ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policy.xml`. ex. <policy domain="module" rights="none" pattern="PS" />. The…

    Published 13 Sept 2021 · Fixed in 6.9.12-22, 7.1.0-7 · NVD
  12. High 8.6

    CVE-2021-39206 · Envoy

    Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded…

    Published 9 Sept 2021 · Fixed in 1.16.5, 1.17.4, 1.18.4 · NVD
  13. High 7.5

    CVE-2021-39204 · Envoy

    Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

    Published 9 Sept 2021 · Fixed in 1.17.4, 1.18.4 · NVD
  14. High 8.6

    CVE-2021-39162 · Envoy

    Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not…

    Published 9 Sept 2021 · Fixed in 1.18.4 · NVD
  15. Medium 5.4

    CVE-2021-39201 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress editor

    Published 9 Sept 2021 · Fixed in 5.8 · NVD, WordPress
  16. Medium 6.5

    CVE-2021-39203 · WordPress

    WordPress 5.8 beta: Private data disclosure/privilege escalation through the block editor

    Published 9 Sept 2021 · NVD, WordPress
  17. Medium 5.3

    CVE-2021-39200 · WordPress

    WordPress: Information Disclosure in wp_die() via JSONP, leading to CSRF

    Published 9 Sept 2021 · Fixed in 5.8.1 · NVD, WordPress
  18. Medium 5.4

    CVE-2021-39202 · WordPress

    WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget editor

    Published 9 Sept 2021 · Fixed in 5.8 · NVD, WordPress
  19. Critical 9.8

    CVE-2021-38540 · Apache Airflow

    The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

    Published 9 Sept 2021 · Fixed in 2.1.3 · NVD
  20. Medium 4.3

    CVE-2021-22239 · GitLab

    An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.

    Published 9 Sept 2021 · Fixed in 14.0.7, 14.1.2 · NVD
  21. High 7.2

    CVE-2021-39459 · REDAXO

    Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code.

    Published 9 Sept 2021 · NVD
  22. Medium 6.5

    CVE-2021-39458 · REDAXO

    Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environment variables.

    Published 9 Sept 2021 · NVD
  23. High 7.5

    CVE-2021-40346 · HAProxy

    An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

    Published 8 Sept 2021 · Fixed in 2.2.17, 2.3.14, 2.4.4 · NVD
  24. Medium 6.5

    CVE-2021-3055 · Palo Alto Networks PAN-OS

    An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by…

    Published 8 Sept 2021 · Fixed in 9.0.14, 9.1.10, 10.0.6 · NVD
  25. Medium 6.6

    CVE-2021-3054 · Palo Alto Networks PAN-OS

    A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS…

    Published 8 Sept 2021 · Fixed in 9.1.11, 10.0.7, 10.1.2 · NVD
  26. High 7.5

    CVE-2021-3053 · Palo Alto Networks PAN-OS

    An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into…

    Published 8 Sept 2021 · Fixed in 9.0.14, 9.1.9, 10.0.5 · NVD
  27. Medium 5.4

    CVE-2021-3052 · Palo Alto Networks PAN-OS

    A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface as the targeted authenticated administrator. This issue impacts: PAN-OS 8.1 versions earlier than…

    Published 8 Sept 2021 · Fixed in 9.0.14, 9.1.10, 10.0.2 · NVD
  28. Medium 6.5

    CVE-2021-28567 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation.

    Published 8 Sept 2021 · NVD
  29. Low 2.7

    CVE-2021-28566 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    Published 8 Sept 2021 · NVD
  30. High 7.8

    CVE-2021-28701 · Xen

    Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can…

    Published 8 Sept 2021 · NVD
  31. Medium 5.4

    CVE-2021-40377 · SmarterMail

    SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application.

    Published 8 Sept 2021 · Fixed in 16.3.7866 · NVD
  32. High 8.8

    CVE-2021-36182 · Fortinet FortiWeb

    A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests

    Published 8 Sept 2021 · Fixed in 6.3.14 · NVD
  33. High 8.8

    CVE-2021-36179 · Fortinet FortiWeb

    A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI command execution

    Published 8 Sept 2021 · NVD
  34. Medium 5.3

    CVE-2020-29012 · Fortinet FortiSandbox

    An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

    Published 8 Sept 2021 · Fixed in 3.2.2 · NVD
  35. Medium 5.3

    CVE-2021-39122 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

    Published 8 Sept 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  36. Medium 4.3

    CVE-2021-39121 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2.

    Published 8 Sept 2021 · Fixed in 8.5.18, 8.13.10, 8.18.2 · NVD
  37. Medium 5.5

    CVE-2021-39116 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF Image Reader component. The affected versions are before version 8.13.14, and from version 8.14.0 before 8.19.0.

    Published 8 Sept 2021 · Fixed in 8.13.14, 8.19.0 · NVD
  38. Critical 9.8

    CVE-2021-32802 · Nextcloud

    Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  39. Medium 5.5

    CVE-2021-32801 · Nextcloud

    Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  40. High 8.1

    CVE-2021-32800 · Nextcloud

    Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  41. Medium 5.3

    CVE-2021-32766 · Nextcloud

    Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not…

    Published 7 Sept 2021 · Fixed in 20.0.12, 21.0.4, 22.1.0 · NVD
  42. High 8.2

    CVE-2021-40143 · Sonatype Nexus Repository

    Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.

    Published 7 Sept 2021 · Fixed in 3.34.1-01 · NVD
  43. Medium 4.9

    CVE-2021-37733 · HPE ArubaOS

    A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.11, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.11, 8.6.0.7, 8.7.1.1 · NVD
  44. Medium 6.2

    CVE-2021-37731 · HPE ArubaOS

    A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.12, 8.6.0.8, 8.7.1.2 · NVD
  45. Medium 6.5

    CVE-2021-37729 · HPE ArubaOS

    A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.3, 8.6.0.9, 8.5.0.12, 8.3.0.16, 6.5.4.19, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.12, 8.6.0.9, 8.7.1.3 · NVD
  46. Medium 6.5

    CVE-2021-37728 · HPE ArubaOS

    A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8.7.1.4, 8.6.0.11, 8.5.0.13. Aruba has released patches for ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.6.0.11, 8.7.1.4, 8.8.0.1 · NVD
  47. High 8.1

    CVE-2021-37725 · HPE ArubaOS

    A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.8.0.1, 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.6.0.8, 8.7.1.2, 8.8.0.1 · NVD
  48. High 7.2

    CVE-2021-37724 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.12, 8.6.0.8, 8.7.1.2 · NVD
  49. High 7.2

    CVE-2021-37723 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.12, 8.6.0.8, 8.7.1.2 · NVD
  50. High 7.2

    CVE-2021-37722 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.13, 8.6.0.9, 8.7.1.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.