UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,117
Published in 7 days
689
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,117 vulnerabilities
  1. Medium 5.4

    CVE-2021-22253 · GitLab

    Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  2. Medium 6.5

    CVE-2021-22252 · GitLab

    A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  3. Medium 4.3

    CVE-2021-22251 · GitLab

    Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  4. Medium 4.3

    CVE-2021-22249 · GitLab

    A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  5. Medium 5.3

    CVE-2021-22248 · GitLab

    Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only

    Published 23 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  6. Critical 9.8

    CVE-2021-38171 · FFmpeg

    adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted.

    Published 21 Aug 2021 · NVD
  7. Medium 4.3

    CVE-2021-22254 · GitLab

    Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9.

    Published 20 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  8. Medium 6.5

    CVE-2021-22246 · GitLab

    A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks.

    Published 20 Aug 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  9. Medium 5.4

    CVE-2021-22238 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.

    Published 20 Aug 2021 · Fixed in 13.12.9, 14.0.7, 14.1.2 · NVD
  10. Medium 6.5

    CVE-2021-39138 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and also allow users to login anonymously. Prior to version 4.5.1, when an anonymous user is first signed up using REST, the server creates session incorrectly. Particularly, the `authProvider` field in `_Session` class under `createdWith` shows…

    Published 19 Aug 2021 · Fixed in 4.5.1 · NVD
  11. High 7.5

    CVE-2021-25218 · BIND 9

    In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition.

    Published 18 Aug 2021 · NVD
  12. High 8.8

    CVE-2021-37702 · Pimcore

    Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

    Published 18 Aug 2021 · Fixed in 10.1.1 · NVD, Project advisories (GitHub)
  13. Medium

    CVE-2021-37695 · Pimcore

    CKEditor 4 vulnerabilities in versions <4.16.1

    Published 18 Aug 2021 · Fixed in 4.16.1 · Project advisories (GitHub)
  14. Critical 9.8

    CVE-2021-37608 · Apache OFBiz

    Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297.

    Published 18 Aug 2021 · Fixed in 17.12.08 · NVD
  15. High 7.5

    CVE-2021-39242 · HAProxy

    An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.

    Published 17 Aug 2021 · Fixed in 2.2.16, 2.3.13, 2.4.3 · NVD
  16. Medium 5.3

    CVE-2021-39241 · HAProxy

    An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.

    Published 17 Aug 2021 · Fixed in 2.2.16, 2.3.13, 2.4.3 · NVD
  17. High 7.5

    CVE-2021-39240 · HAProxy

    An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.

    Published 17 Aug 2021 · Fixed in 2.2.16, 2.3.13, 2.4.3 · NVD
  18. High 8.1

    CVE-2020-29548 · SmarterMail

    An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, injecting plaintext commands into an encrypted user session.

    Published 17 Aug 2021 · NVD
  19. High 8.8

    CVE-2021-25957 · Dolibarr ERP CRM

    In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.

    Published 17 Aug 2021 · NVD
  20. High 7.2

    CVE-2021-25956 · Dolibarr ERP CRM

    In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

    Published 17 Aug 2021 · NVD
  21. High 7.5

    CVE-2021-22940 · Node.js

    Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

    Published 16 Aug 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD
  22. Medium 5.3

    CVE-2021-22939 · Node.js

    If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

    Published 16 Aug 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD
  23. High 7.2

    CVE-2021-22938 · Ivanti Connect Secure

    A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.

    Published 16 Aug 2021 · NVD
  24. High 7.2

    CVE-2021-22937 · Ivanti Connect Secure

    A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.

    Published 16 Aug 2021 · NVD
  25. Medium 6.1

    CVE-2021-22936 · Ivanti Connect Secure

    A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.

    Published 16 Aug 2021 · NVD
  26. High 7.2

    CVE-2021-22935 · Ivanti Connect Secure

    A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.

    Published 16 Aug 2021 · NVD
  27. High 7.2

    CVE-2021-22934 · Ivanti Connect Secure

    A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.

    Published 16 Aug 2021 · NVD
  28. Medium 6.5

    CVE-2021-22933 · Ivanti Connect Secure

    A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.

    Published 16 Aug 2021 · NVD
  29. Critical 9.8

    CVE-2021-22931 · Node.js

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

    Published 16 Aug 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD
  30. High 8.8

    CVE-2021-37711 · Shopware

    Authenticated server-side request forgery in file upload via URL.

    Published 16 Aug 2021 · Fixed in 6.4.3.1 · NVD, Project advisories (GitHub)
  31. Medium 5.4

    CVE-2021-37710 · Shopware

    Cross-Site Scripting via SVG media files

    Published 16 Aug 2021 · Fixed in 6.4.3.1 · NVD, Project advisories (GitHub)
  32. Medium 6.5

    CVE-2021-37709 · Shopware

    Insecure direct object reference of log files of the Import/Export feature

    Published 16 Aug 2021 · Fixed in 6.4.3.1 · NVD, Project advisories (GitHub)
  33. Critical 9.8

    CVE-2021-37708 · Shopware

    Command injection in mail agent settings

    Published 16 Aug 2021 · Fixed in 6.4.3.1 · NVD, Project advisories (GitHub)
  34. High 7.5

    CVE-2021-37707 · Shopware

    Manipulation of product reviews via API

    Published 16 Aug 2021 · Fixed in 6.4.3.1 · NVD, Project advisories (GitHub)
  35. Medium 5.3

    CVE-2021-35936 · Apache Airflow

    If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

    Published 16 Aug 2021 · Fixed in 2.1.2 · NVD
  36. High 7.5

    CVE-2021-33193 · Apache HTTP Server

    A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

    Published 16 Aug 2021 · Fixed in 2.4.49 · NVD
  37. Medium 5.3Actively exploited

    CVE-2021-26086 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

    Published 16 Aug 2021 · Fixed in 8.5.14, 8.13.6, 8.16.1 · NVD
  38. Medium 5.4

    CVE-2021-34641 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 16 Aug 2021 · WPVulnerability
  39. Critical 9.0

    CVE-2021-25955 · Dolibarr ERP CRM

    In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who…

    Published 15 Aug 2021 · NVD
  40. Medium 5.4

    CVE-2021-36788 · Yoast SEO

    The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.

    Published 13 Aug 2021 · Fixed in 7.2.3 · NVD
  41. Medium 5.3

    CVE-2021-38554 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

    Published 13 Aug 2021 · Fixed in 1.8.0 · NVD
  42. Medium 4.4

    CVE-2021-38553 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

    Published 13 Aug 2021 · Fixed in 1.8.0 · NVD
  43. Medium 4.3

    CVE-2021-37703 · Discourse

    Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the last read post number and the notification level is exposed.

    Published 13 Aug 2021 · Fixed in 2.7.8 · NVD
  44. High 7.5

    CVE-2021-37693 · Discourse

    Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including…

    Published 13 Aug 2021 · Fixed in 2.7.8 · NVD
  45. Medium 6.1

    CVE-2021-37352 · Nagios XI

    An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD
  46. Medium 5.3

    CVE-2021-37351 · Nagios XI

    Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD
  47. Critical 9.8

    CVE-2021-37350 · Nagios XI

    Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD
  48. High 7.8

    CVE-2021-37349 · Nagios XI

    Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD
  49. High 7.5

    CVE-2021-37348 · Nagios XI

    Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD
  50. High 7.8

    CVE-2021-37347 · Nagios XI

    Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.