UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,115
Published in 7 days
687
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,115 vulnerabilities
  1. Medium 4.8

    CVE-2021-39117 · Jira

    The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.

    Published 30 Aug 2021 · Fixed in 8.18.0 · NVD
  2. High 7.5

    CVE-2021-39113 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0.

    Published 30 Aug 2021 · Fixed in 8.13.9, 8.18.0 · NVD
  3. Medium 6.1

    CVE-2021-39111 · Jira

    The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field.

    Published 30 Aug 2021 · Fixed in 8.5.18, 8.13.10, 8.18.2 · NVD
  4. Critical 9.8Actively exploited

    CVE-2021-26084 · Confluence

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

    Published 30 Aug 2021 · Fixed in 7.4.11, 7.11.6, 7.12.5 · NVD
  5. Medium 4.8

    CVE-2021-24610 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 30 Aug 2021 · Fixed in 2.0.9 · WPVulnerability
  6. Medium 4.8

    CVE-2021-24569 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 30 Aug 2021 · Fixed in 2.1.4 · WPVulnerability
  7. Medium 4.9

    CVE-2021-28700 · Xen

    xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.

    Published 27 Aug 2021 · NVD
  8. Medium 5.5

    CVE-2021-28699 · Xen

    inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has to occur because the…

    Published 27 Aug 2021 · NVD
  9. Medium 5.5

    CVE-2021-28698 · Xen

    long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would iterate over all such entries, including ones which aren't in use anymore and some which may have been created but never used. If the number of…

    Published 27 Aug 2021 · NVD
  10. High 7.8

    CVE-2021-28697 · Xen

    grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in…

    Published 27 Aug 2021 · NVD
  11. Medium 6.8

    CVE-2021-28696 · Xen

    IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI…

    Published 27 Aug 2021 · NVD
  12. Medium 6.8

    CVE-2021-28695 · Xen

    IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI…

    Published 27 Aug 2021 · NVD
  13. Medium 6.8

    CVE-2021-28694 · Xen

    IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI…

    Published 27 Aug 2021 · NVD
  14. Medium 5.4

    CVE-2021-39161 · Discourse

    Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This…

    Published 26 Aug 2021 · Fixed in 2.7.8 · NVD
  15. Medium 6.1

    CVE-2021-20815 · Movable Type

    Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject…

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  16. Medium 6.1

    CVE-2021-20814 · Movable Type

    Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  17. Medium 6.1

    CVE-2021-20813 · Movable Type

    Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) and Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series)) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  18. Medium 6.1

    CVE-2021-20812 · Movable Type

    Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series) and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  19. Medium 6.1

    CVE-2021-20811 · Movable Type

    Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject…

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  20. Medium 6.1

    CVE-2021-20810 · Movable Type

    Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject…

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  21. Medium 6.1

    CVE-2021-20809 · Movable Type

    Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows…

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  22. Medium 6.1

    CVE-2021-20808 · Movable Type

    Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type 6.8.0 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.44 and earlier, and Movable Type Premium Advanced 1.44 and earlier) allows remote attackers to inject arbitrary…

    Published 26 Aug 2021 · Fixed in 7.8.0 · NVD
  23. High 7.4

    CVE-2021-29487 · October CMS

    Auth Bypass

    Published 26 Aug 2021 · Fixed in 1.0.472, 1.1.5 · NVD, Project advisories (GitHub)
  24. Critical 9.1Actively exploited

    CVE-2021-32648 · October CMS

    Account Takeover

    Published 26 Aug 2021 · Fixed in 1.1.5 · NVD, Project advisories (GitHub)
  25. Medium 5.4

    CVE-2021-22256 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  26. Medium 5.4

    CVE-2021-22250 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  27. Medium 4.3

    CVE-2021-22247 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  28. Low 2.7

    CVE-2021-22245 · GitLab

    Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  29. Medium 6.5

    CVE-2021-22244 · GitLab

    Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  30. Medium 4.3

    CVE-2021-22243 · GitLab

    Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  31. Medium 5.4

    CVE-2021-22242 · GitLab

    Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  32. Medium 4.9

    CVE-2021-22237 · GitLab

    Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2

    Published 25 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  33. High 8.8

    CVE-2021-22236 · GitLab

    Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.

    Published 25 Aug 2021 · Fixed in 14.1.2 · NVD
  34. Medium 4.8

    CVE-2021-39112 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1.

    Published 25 Aug 2021 · Fixed in 8.13.7, 8.17.1, 8.18.1 · NVD
  35. Unrated

    WPV-fc28a35cc350 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 25 Aug 2021 · Fixed in 5.10 · WPVulnerability
  36. High 7.5

    CVE-2021-32780 · Envoy

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0.…

    Published 24 Aug 2021 · Fixed in 1.18.4 · NVD
  37. High 8.3

    CVE-2021-32777 · Envoy

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass…

    Published 24 Aug 2021 · Fixed in 1.16.5, 1.17.4, 1.18.4 · NVD
  38. High 7.5

    CVE-2021-32781 · Envoy

    Continued processing of requests after locally generated response

    Published 24 Aug 2021 · Fixed in 1.16.5, 1.17.4, 1.18.4 · NVD, Project advisories (GitHub)
  39. High 7.5

    CVE-2021-32778 · Envoy

    Excessive CPU utilization when closing HTTP/2 streams

    Published 24 Aug 2021 · Fixed in 1.16.5, 1.17.4, 1.18.4 · NVD, Project advisories (GitHub)
  40. High 8.3

    CVE-2021-32779 · Envoy

    Incorrectly handling of URI '#fragment' element as part of the path element

    Published 24 Aug 2021 · Fixed in 1.16.5, 1.17.4, 1.18.4 · NVD, Project advisories (GitHub)
  41. Medium 6.1

    CVE-2021-28628 · Adobe Experience Manager

    Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 24 Aug 2021 · NVD
  42. High 8.8

    CVE-2021-28627 · Adobe Experience Manager

    Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interaction.

    Published 24 Aug 2021 · NVD
  43. High 7.5

    CVE-2021-28626 · Adobe Experience Manager

    Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by an Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service. Exploitation of this issue does not require user interaction.

    Published 24 Aug 2021 · NVD
  44. Medium 6.1

    CVE-2021-28625 · Adobe Experience Manager

    Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 24 Aug 2021 · NVD
  45. High 7.4

    CVE-2021-3712 · OpenSSL, MySQL

    ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i"…

    Published 24 Aug 2021 · Fixed in 1.0.2za, 1.1.1l · NVD
  46. Critical 9.8

    CVE-2021-3711 · OpenSSL, MySQL

    In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized…

    Published 24 Aug 2021 · Fixed in 1.1.1l · NVD
  47. Critical 9.1

    CVE-2021-26040 · Joomla!

    An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

    Published 24 Aug 2021 · NVD
  48. High 7.5

    CVE-2021-36690 · SQLite

    A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

    Published 24 Aug 2021 · NVD
  49. Medium 5.4

    CVE-2021-22253 · GitLab

    Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  50. Medium 6.5

    CVE-2021-22252 · GitLab

    A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.