UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,117
Published in 7 days
689
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,117 vulnerabilities
  1. High 7.8

    CVE-2021-37345 · Nagios XI

    Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD
  2. High 8.8

    CVE-2021-37343 · Nagios XI

    A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.

    Published 13 Aug 2021 · Fixed in 5.8.5 · NVD
  3. Critical 9.8

    CVE-2021-31556 · MediaWiki

    An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob.

    Published 12 Aug 2021 · NVD
  4. Medium 5.5

    CVE-2021-34532 · .NET

    ASP.NET Core and Visual Studio Information Disclosure Vulnerability

    Published 12 Aug 2021 · NVD
  5. Medium 5.0

    CVE-2021-34485 · .NET

    .NET Core and Visual Studio Information Disclosure Vulnerability

    Published 12 Aug 2021 · NVD
  6. High 7.5

    CVE-2021-26423 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 12 Aug 2021 · NVD
  7. High 7.5

    CVE-2021-38604 · GNU C Library

    In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

    Published 12 Aug 2021 · NVD
  8. High 7.5

    CVE-2021-38291 · FFmpeg

    FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.

    Published 12 Aug 2021 · Fixed in 4.2.5, 4.3.3, 4.4.1 · NVD
  9. Medium 5.5

    CVE-2021-38590 · cPanel & WHM

    In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).

    Published 11 Aug 2021 · Fixed in 11.98.0.8 · NVD
  10. High 8.1

    CVE-2021-38589 · cPanel & WHM

    In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).

    Published 11 Aug 2021 · Fixed in 11.96.0.13 · NVD
  11. High 8.1

    CVE-2021-38588 · cPanel & WHM

    In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).

    Published 11 Aug 2021 · Fixed in 96.0.13 · NVD
  12. High 7.5

    CVE-2021-38587 · cPanel & WHM

    In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).

    Published 11 Aug 2021 · Fixed in 96.0.13 · NVD
  13. Medium 4.4

    CVE-2021-38586 · cPanel & WHM

    In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).

    Published 11 Aug 2021 · Fixed in 11.94.0.13, 11.96.0.13, 11.98.0.1 · NVD
  14. High 7.2

    CVE-2021-38585 · cPanel & WHM

    The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).

    Published 11 Aug 2021 · Fixed in 98.0.1 · NVD
  15. High 7.2

    CVE-2021-38584 · cPanel & WHM

    The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).

    Published 11 Aug 2021 · Fixed in 98.0.1 · NVD
  16. High 8.8

    CVE-2021-3050 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 9.0 version 9.0.10 through PAN-OS 9.0.14; PAN-OS 9.1 version 9.1.4 through PAN-OS 9.1.10; PAN-OS 10.0 version 10.0.7 and earlier PAN-OS 10.0 versions; PAN-OS 10.1 version 10.1.0 through…

    Published 11 Aug 2021 · Fixed in 9.1.11, 10.0.8, 10.1.2 · NVD
  17. Medium 5.9

    CVE-2021-3048 · Palo Alto Networks PAN-OS

    Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall remains otherwise functional. If the firewall then restarts, it results in a denial-of-service…

    Published 11 Aug 2021 · Fixed in 9.0.14, 9.1.9, 10.0.5 · NVD
  18. Low 3.1

    CVE-2021-3047 · Palo Alto Networks PAN-OS

    A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to impersonate another authenticated web interface administrator's session. This issue impacts: PAN-OS 8.1…

    Published 11 Aug 2021 · Fixed in 9.0.14, 9.1.10, 10.0.4 · NVD
  19. Medium 6.5

    CVE-2021-3046 · Palo Alto Networks PAN-OS

    An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user in the GlobalProtect Portal and GlobalProtect Gateway when they are configured to use SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1…

    Published 11 Aug 2021 · Fixed in 9.0.14, 9.1.9, 10.0.5 · NVD
  20. Medium 4.9

    CVE-2021-3045 · Palo Alto Networks PAN-OS

    An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10. PAN-OS 10.0 and later versions are not impacted.

    Published 11 Aug 2021 · Fixed in 8.1.19, 9.0.14, 9.1.10 · NVD
  21. Medium

    CVE-2021-37699 · Next.js

    Open Redirect in Next.js versions below 11.1.0

    Published 11 Aug 2021 · Fixed in 11.1.0 · Project advisories (GitHub)
  22. High 7.2

    CVE-2021-37627 · Contao

    Privilege escalation with the form generator

    Published 11 Aug 2021 · Fixed in 4.4.56, 4.9.18, 4.11.7 · NVD, Project advisories (GitHub)
  23. High 7.2

    CVE-2021-37626 · Contao

    PHP file inclusion via insert tags

    Published 11 Aug 2021 · Fixed in 4.4.56, 4.9.18, 4.11.7 · NVD, Project advisories (GitHub)
  24. Medium 4.8

    CVE-2021-35955 · Contao

    Cross-site scripting via HTML attributes in the back end

    Published 11 Aug 2021 · Fixed in 4.4.56, 4.9.18, 4.11.7 · NVD, Project advisories (GitHub)
  25. Medium 6.5

    CVE-2020-21697 · FFmpeg

    A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file.

    Published 10 Aug 2021 · NVD
  26. High 8.8

    CVE-2020-21688 · FFmpeg

    A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code.

    Published 10 Aug 2021 · NVD
  27. Medium 5.4

    CVE-2021-37391 · Chamilo LMS

    A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.

    Published 10 Aug 2021 · Fixed in 1.11.14 · NVD
  28. Medium 6.1

    CVE-2021-37390 · Chamilo LMS

    A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).

    Published 10 Aug 2021 · Fixed in 1.11.14 · NVD
  29. High 7.5

    CVE-2021-38371 · Exim

    The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.

    Published 10 Aug 2021 · NVD
  30. Medium 5.4

    CVE-2021-37152 · Sonatype Nexus Repository

    Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications.

    Published 10 Aug 2021 · Fixed in 3.33.0 · NVD
  31. Medium 6.1

    CVE-2021-32768 · TYPO3

    Cross-Site Scripting via Rich-Text Content

    Published 10 Aug 2021 · Fixed in 11.3.2 · NVD, Project advisories (GitHub)
  32. Medium 6.1

    CVE-2021-37633 · Discourse

    Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable` 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy…

    Published 9 Aug 2021 · Fixed in 2.7.8 · NVD
  33. Medium 4.3

    CVE-2021-25954 · Dolibarr ERP CRM

    In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.

    Published 9 Aug 2021 · NVD
  34. Critical 9.8

    CVE-2021-22910 · Rocket.Chat

    A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.

    Published 9 Aug 2021 · Fixed in 3.11.4, 3.12.4, 3.13.2 · NVD
  35. Critical 9.8

    CVE-2021-38159 · MOVEit Transfer

    In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or…

    Published 7 Aug 2021 · Fixed in 2020.0.7, 2020.1.6, 2021.0.4 · NVD
  36. Critical 9.1

    CVE-2021-29922 · Rust

    library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

    Published 7 Aug 2021 · Fixed in 1.53.0 · NVD
  37. High 7.5

    CVE-2021-37548 · TeamCity

    In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.

    Published 6 Aug 2021 · Fixed in 2021.1 · NVD
  38. Medium 5.3

    CVE-2021-37547 · TeamCity

    In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.

    Published 6 Aug 2021 · Fixed in 2020.2.4 · NVD
  39. Medium 5.3

    CVE-2021-37546 · TeamCity

    In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.

    Published 6 Aug 2021 · Fixed in 2021.1 · NVD
  40. High 7.5

    CVE-2021-37545 · TeamCity

    In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.

    Published 6 Aug 2021 · Fixed in 2021.1 · NVD
  41. Critical 9.8

    CVE-2021-37544 · TeamCity

    In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.

    Published 6 Aug 2021 · Fixed in 2020.2.4 · NVD
  42. Medium 6.1

    CVE-2021-37542 · TeamCity

    In JetBrains TeamCity before 2020.2.3, XSS was possible.

    Published 6 Aug 2021 · Fixed in 2020.2.3 · NVD
  43. Medium 5.5

    CVE-2021-3566 · FFmpeg

    Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

    Published 5 Aug 2021 · Fixed in 4.3 · NVD
  44. High 7.5

    CVE-2021-37156 · Redmine

    Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.

    Published 5 Aug 2021 · NVD
  45. High 8.1

    CVE-2021-22927 · NetScaler ADC and Gateway

    A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

    Published 5 Aug 2021 · Fixed in 11.1-65.22 · NVD
  46. High 7.5

    CVE-2021-22926 · curl, MySQL

    libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will…

    Published 5 Aug 2021 · Fixed in 7.78.0 · NVD
  47. Medium 5.3

    CVE-2021-22925 · curl, MySQL

    curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to…

    Published 5 Aug 2021 · Fixed in 7.78.0 · NVD
  48. Low 3.7

    CVE-2021-22924 · curl, MySQL

    libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but…

    Published 5 Aug 2021 · Fixed in 7.77.0 · NVD
  49. Medium 5.3

    CVE-2021-22923 · curl, MySQL

    When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

    Published 5 Aug 2021 · Fixed in 7.78.0 · NVD
  50. Medium 6.5

    CVE-2021-22922 · curl, MySQL

    When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of…

    Published 5 Aug 2021 · Fixed in 7.78.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.