Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,117
- Published in 7 days
- 689
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,117 vulnerabilities- High 7.5
CVE-2021-22919 · NetScaler ADC and Gateway
A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed.
Published 5 Aug 2021 · Fixed in 11.1-65.22 · NVD - Medium 6.4
CVE-2021-22234 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server.
Published 5 Aug 2021 · NVD - Medium 6.1
CVE-2021-37859 · Mattermost
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
Published 5 Aug 2021 · Fixed in 5.34.5, 5.35.4, 5.36.1 · NVD - High 8.8
CVE-2021-37614 · MOVEit Transfer
In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or…
Published 5 Aug 2021 · Fixed in 2020.0.6, 2020.1.5, 2021.0.3 · NVD - Medium 5.4
CVE-2021-22241 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name.
Published 5 Aug 2021 · Fixed in 14.0.7, 14.1.2 · NVD - Medium 4.3
CVE-2021-22240 · GitLab
Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled
Published 5 Aug 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD - High 7.5
CVE-2021-31869 · Pimcore
Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in version 6.9.4 of the product.
Published 4 Aug 2021 · Fixed in 6.9.4 · NVD - Medium 5.5
CVE-2021-38114 · FFmpeg
libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.
Published 4 Aug 2021 · NVD - Medium 6.1
CVE-2021-24014 · Fortinet FortiSandbox
Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an XSS attack via specifically crafted request parameters.
Published 4 Aug 2021 · Fixed in 3.2.3 · NVD - High 7.5
CVE-2021-22124 · Fortinet FortiSandbox
An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters.
Published 4 Aug 2021 · Fixed in 3.0.7, 3.1.5, 3.2.2 · NVD - High 8.8
CVE-2021-26096 · Fortinet FortiSandbox
Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content by means of specifically crafted command line arguments.
Published 4 Aug 2021 · Fixed in 3.2.3 · NVD - High 8.8
CVE-2021-26097 · Fortinet FortiSandbox
An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6 may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests.
Published 4 Aug 2021 · Fixed in 3.0.7, 3.1.5, 3.2.3 · NVD - High 8.8
CVE-2020-29011 · Fortinet FortiSandbox
Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated attacker to execute unauthorized code on the underlying SQL interpreter via specifically crafted HTTP requests.
Published 4 Aug 2021 · Fixed in 3.1.5, 3.2.2 · NVD - High 8.8
CVE-2021-24018 · Fortinet FortiOS
A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted firmware image.
Published 4 Aug 2021 · Fixed in 6.2.10, 6.4.7 · NVD - Medium 6.5
CVE-2021-24010 · Fortinet FortiSandbox
Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated user to obtain unauthorized access to files and data via specifially crafted web requests.
Published 4 Aug 2021 · Fixed in 3.1.5, 3.2.3 · NVD - Medium 6.1
CVE-2021-35463 · Liferay Portal / DXP
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.
Published 4 Aug 2021 · NVD - High 7.5
CVE-2021-33338 · Liferay Portal / DXP
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.
Published 4 Aug 2021 · NVD - Medium 6.1
CVE-2021-33337 · Liferay Portal / DXP
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
Published 4 Aug 2021 · NVD - High 7.5
CVE-2021-26098 · Fortinet FortiSandbox
An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs.
Published 4 Aug 2021 · Fixed in 3.2.3 · NVD - Medium 4.8
CVE-2021-33339 · Liferay Portal / DXP
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.
Published 4 Aug 2021 · Fixed in 7.3.5 · NVD - Medium 5.4
CVE-2021-33336 · Liferay Portal / DXP
Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.
Published 4 Aug 2021 · Fixed in 7.3.4 · NVD - High 7.2
CVE-2021-33335 · Liferay Portal / DXP
Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.
Published 3 Aug 2021 · Fixed in 7.3.5 · NVD - Medium 4.3
CVE-2021-33334 · Liferay Portal / DXP
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration.
Published 3 Aug 2021 · Fixed in 7.3.3 · NVD - Medium 6.3
CVE-2021-33333 · Liferay Portal / DXP
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.
Published 3 Aug 2021 · Fixed in 7.3.3 · NVD - Medium 6.1
CVE-2021-33332 · Liferay Portal / DXP
Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.
Published 3 Aug 2021 · Fixed in 7.3.3 · NVD - Medium 6.1
CVE-2021-33331 · Liferay Portal / DXP
Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter.
Published 3 Aug 2021 · Fixed in 7.3.2 · NVD - High 8.1
CVE-2021-32813 · Traefik
Drop Headers via Malicious Connection Header
Published 3 Aug 2021 · Fixed in 2.4.13 · NVD, Project advisories (GitHub) - Medium 4.3
CVE-2021-33330 · Liferay Portal / DXP
Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.
Published 3 Aug 2021 · Fixed in 7.3.3 · NVD - Medium 5.4
CVE-2021-33328 · Liferay Portal / DXP
Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2)…
Published 3 Aug 2021 · Fixed in 7.3.5 · NVD - Medium 4.3
CVE-2021-33327 · Liferay Portal / DXP
The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
Published 3 Aug 2021 · Fixed in 7.3.4 · NVD - Medium 6.1
CVE-2021-33326 · Liferay Portal / DXP
Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.
Published 3 Aug 2021 · Fixed in 7.3.5 · NVD - Medium 4.9
CVE-2021-33325 · Liferay Portal / DXP
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password.
Published 3 Aug 2021 · Fixed in 7.3.3 · NVD - Medium 4.3
CVE-2021-33324 · Liferay Portal / DXP
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
Published 3 Aug 2021 · Fixed in 7.3.2 · NVD - High 7.5
CVE-2021-33323 · Liferay Portal / DXP
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.
Published 3 Aug 2021 · Fixed in 7.3.1 · NVD - High 7.5
CVE-2021-33322 · Liferay Portal / DXP
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
Published 3 Aug 2021 · Fixed in 7.3.1 · NVD - High 7.5
CVE-2021-33321 · Liferay Portal / DXP
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
Published 3 Aug 2021 · Fixed in 7.3.3 · NVD - Medium 4.3
CVE-2021-33320 · Liferay Portal / DXP
The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails
Published 3 Aug 2021 · Fixed in 7.3.1 · NVD - Medium 5.3Actively exploited
CVE-2021-26085 · Confluence
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Published 3 Aug 2021 · Fixed in 7.4.10, 7.12.3 · NVD - High 8.8
CVE-2021-37840 · aaPanel
aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).
Published 2 Aug 2021 · NVD - High 8.8
CVE-2017-18113 · Jira
The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue…
Published 2 Aug 2021 · Fixed in 8.18.1 · NVD - High 7.4
CVE-2021-32066 · Ruby
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Published 1 Aug 2021 · NVD - High 7.2
CVE-2021-36766 · Concrete CMS
Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request parameter is not properly sanitized before being used in a call to the file_exists() PHP function. This can be exploited by malicious users to inject…
Published 30 Jul 2021 · Fixed in 8.5.6 · NVD - High 7.5
CVE-2021-28966 · Ruby
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
Published 30 Jul 2021 · Fixed in 2.7.3, 3.0.1 · NVD - High 8.8
CVE-2021-29736 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300.
Published 30 Jul 2021 · NVD - Critical 9.8
CVE-2020-36239 · Jira
Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port…
Published 29 Jul 2021 · Fixed in 8.5.16, 8.13.8, 8.17.0 · NVD - Medium 4.3
CVE-2021-32788 · Discourse
Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the…
Published 27 Jul 2021 · Fixed in 2.7.7 · NVD - Medium 6.5
CVE-2021-22144 · Elasticsearch
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
Published 26 Jul 2021 · Fixed in 6.8.17, 7.13.3 · NVD - Medium 5.3
CVE-2021-20333 · MongoDB
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10.
Published 23 Jul 2021 · Fixed in 3.6.20, 4.0.21, 4.2.10 · NVD - Medium 6.1
CVE-2021-34630 · Gtranslate (WordPress plugin)
Translate WordPress with GTranslate: Cross-site Scripting
Published 23 Jul 2021 · Fixed in 2.8.65 · WPVulnerability - High 7.5
CVE-2021-36222 · MySQL
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.
Published 22 Jul 2021 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.