UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,115
Published in 7 days
687
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,115 vulnerabilities
  1. High 7.2

    CVE-2021-37721 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.13, 8.6.0.9, 8.7.1.4 · NVD
  2. High 7.2

    CVE-2021-37720 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.13, 8.6.0.9, 8.7.1.4 · NVD
  3. High 7.2

    CVE-2021-37719 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.13, 8.6.0.9, 8.7.1.4 · NVD
  4. High 7.2

    CVE-2021-37718 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.12, 8.6.0.7, 8.7.1.4 · NVD
  5. High 7.2

    CVE-2021-37717 · HPE ArubaOS

    A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.12, 8.6.0.6, 8.7.1.4 · NVD
  6. Critical 9.8

    CVE-2021-37716 · HPE ArubaOS

    A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.5.0.12, 8.6.0.8, 8.7.1.2 · NVD
  7. Medium 6.5

    CVE-2019-5318 · HPE ArubaOS

    A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions, 8.x.x.x: all versions prior to 8.8.0.0. Aruba has released patches for ArubaOS that address this security vulnerability.

    Published 7 Sept 2021 · Fixed in 8.8.0.0 · NVD
  8. Medium 4.3

    CVE-2020-15939 · Fortinet FortiSandbox

    An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL.

    Published 6 Sept 2021 · Fixed in 3.1.5, 3.2.2 · NVD
  9. Medium 4.8

    CVE-2021-25737 · Kubernetes

    A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

    Published 6 Sept 2021 · Fixed in 1.18.19, 1.19.10, 1.20.7 · NVD
  10. Medium 6.5

    CVE-2021-25735 · Kubernetes

    A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

    Published 6 Sept 2021 · Fixed in 1.18.18, 1.19.10, 1.20.6 · NVD
  11. High 7.5

    CVE-2021-40524 · Pure-FTPd

    In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)

    Published 5 Sept 2021 · Fixed in 1.0.50 · NVD
  12. High 7.2

    CVE-2021-39192 · Ghost

    Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator…

    Published 3 Sept 2021 · Fixed in 4.10.0 · NVD
  13. High 7.5

    CVE-2021-39187 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No…

    Published 2 Sept 2021 · Fixed in 4.10.3 · NVD
  14. Medium 5.3

    CVE-2021-39119 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0.

    Published 1 Sept 2021 · Fixed in 8.19.0 · NVD
  15. High 7.5

    CVE-2021-36044 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.

    Published 1 Sept 2021 · NVD
  16. Medium 6.6

    CVE-2021-36043 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.

    Published 1 Sept 2021 · NVD
  17. High 7.2

    CVE-2021-36042 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

    Published 1 Sept 2021 · NVD
  18. High 7.2

    CVE-2021-36041 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.

    Published 1 Sept 2021 · NVD
  19. High 7.2

    CVE-2021-36040 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.

    Published 1 Sept 2021 · NVD
  20. Medium 6.5

    CVE-2021-36039 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.

    Published 1 Sept 2021 · NVD
  21. Medium 6.5

    CVE-2021-36038 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.

    Published 1 Sept 2021 · NVD
  22. Medium 6.5

    CVE-2021-36037 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.

    Published 1 Sept 2021 · NVD
  23. High 7.2

    CVE-2021-36035 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could make a crafted request to the Adobe Stock API to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  24. High 7.2

    CVE-2021-36034 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  25. High 7.2

    CVE-2021-36033 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  26. High 8.8

    CVE-2021-36032 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.

    Published 1 Sept 2021 · NVD
  27. High 7.2

    CVE-2021-36031 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  28. High 7.5

    CVE-2021-36030 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.

    Published 1 Sept 2021 · NVD
  29. High 7.2

    CVE-2021-36029 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  30. High 7.2

    CVE-2021-36028 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  31. Medium 6.1

    CVE-2021-36027 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 1 Sept 2021 · NVD
  32. Medium 6.1

    CVE-2021-36026 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the…

    Published 1 Sept 2021 · NVD
  33. High 7.2

    CVE-2021-36025 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  34. High 7.2

    CVE-2021-36024 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  35. High 7.2

    CVE-2021-36022 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  36. Critical 9.8

    CVE-2021-36020 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

    Published 1 Sept 2021 · NVD
  37. Medium 6.5

    CVE-2021-36012 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.

    Published 1 Sept 2021 · NVD
  38. Medium 5.4

    CVE-2021-39166 · Pimcore

    Improper Neutralization of Text-Values in Object Version Preview

    Published 1 Sept 2021 · Fixed in 10.1.1, 10.1.2 · NVD, Project advisories (GitHub)
  39. Medium 5.4

    CVE-2021-39170 · Pimcore

    Improper Encoding or Escaping of Output in Asset Metadata Component & SEO Editor

    Published 1 Sept 2021 · Fixed in 10.1.1, 10.1.2 · NVD, Project advisories (GitHub)
  40. Medium 5.3

    CVE-2021-27668 · HashiCorp Vault

    HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

    Published 31 Aug 2021 · Fixed in 1.6.3 · NVD
  41. High 8.8

    CVE-2021-35223 · SolarWinds Serv-U

    The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.

    Published 31 Aug 2021 · Fixed in 15.2.4 · NVD
  42. Medium 5.4

    CVE-2020-19049 · MyBB

    Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.

    Published 31 Aug 2021 · NVD
  43. Medium 5.4

    CVE-2020-19048 · MyBB

    Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.

    Published 31 Aug 2021 · NVD
  44. Medium 6.5

    CVE-2021-32832 · Rocket.Chat

    Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.

    Published 30 Aug 2021 · Fixed in 3.11.3, 3.12.2 · NVD
  45. High 7.5

    CVE-2021-25958 · Apache OFBiz

    In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.

    Published 30 Aug 2021 · Fixed in 17.12.08 · NVD
  46. Low 3.5

    CVE-2021-27913 · Mautic

    Use of a Broken or Risky Cryptographic Algorithm

    Published 30 Aug 2021 · Fixed in 3.3.4 · NVD, Project advisories (GitHub)
  47. Medium 6.1

    CVE-2021-27909 · Mautic

    XSS vulnerability on password reset page

    Published 30 Aug 2021 · Fixed in 3.3.4 · NVD, Project advisories (GitHub)
  48. Medium 6.1

    CVE-2021-27910 · Mautic

    Stored XSS vulnerability on Bounce Management Callback

    Published 30 Aug 2021 · Fixed in 3.3.4 · NVD, Project advisories (GitHub)
  49. Medium 6.1

    CVE-2021-27911 · Mautic

    XSS vulnerability on contacts view

    Published 30 Aug 2021 · Fixed in 3.3.4 · NVD, Project advisories (GitHub)
  50. Medium 5.4

    CVE-2021-27912 · Mautic

    XSS vulnerability on asset view

    Published 30 Aug 2021 · Fixed in 3.3.4 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.