Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,118
- Published in 7 days
- 690
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,118 vulnerabilities- Medium 6.5
CVE-2020-20219 · MikroTik RouterOS
Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
Published 21 Jul 2021 · NVD - Medium 6.5
CVE-2021-32767 · TYPO3
Information Disclosure in User Authentication
Published 20 Jul 2021 · Fixed in 11.3.1 · NVD, Project advisories (GitHub) - High 7.2
CVE-2021-22125 · Fortinet FortiSandbox
An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file.
Published 20 Jul 2021 · Fixed in 3.2.2 · NVD - Medium 5.4
CVE-2021-32669 · TYPO3
Cross-Site Scripting in Backend Grid View
Published 20 Jul 2021 · Fixed in 11.3.1 · NVD, Project advisories (GitHub) - Medium 4.8
CVE-2021-32668 · TYPO3
Cross-Site Scripting in Query Generator & Query View
Published 20 Jul 2021 · Fixed in 11.3.1 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2021-32667 · TYPO3
Cross-Site Scripting in Page Preview
Published 20 Jul 2021 · Fixed in 11.3.1 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2021-32763 · OpenProject
Regular Expression Denial of Service in OpenProject forum messages
Published 20 Jul 2021 · Fixed in 11.3.3 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2021-26083 · Jira
Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
Published 20 Jul 2021 · Fixed in 8.5.14, 8.13.6, 8.16.1 · NVD - Medium 5.4
CVE-2021-26082 · Jira
The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.
Published 20 Jul 2021 · Fixed in 8.5.14, 8.13.6, 8.17.0 · NVD - Medium 5.3
CVE-2021-26081 · Jira
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.
Published 20 Jul 2021 · Fixed in 8.5.14, 8.13.6, 8.16.1 · NVD - Medium 6.3
CVE-2021-32760 · containerd
Archive package allows chmod of file outside of unpack target directory
Published 19 Jul 2021 · Fixed in 1.4.8, 1.5.4 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2020-20249 · MikroTik RouterOS
Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet, an authenticated remote attacker can cause a Denial of Service.
Published 19 Jul 2021 · Fixed in 6.47 · NVD - Medium 6.5
CVE-2020-20248 · MikroTik RouterOS
Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.
Published 19 Jul 2021 · NVD - Medium 6.5
CVE-2020-20230 · MikroTik RouterOS
Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.
Published 19 Jul 2021 · Fixed in 6.47 · NVD - High 7.7
CVE-2021-1422 · Cisco ASA and Firepower Threat Defense
A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic…
Published 16 Jul 2021 · NVD - Medium 5.4
CVE-2021-32764 · Discourse
Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in `stable` version 2.7.6, `beta` version 2.8.0.beta3, and `tests-passed` version 2.8.0.beta3. As…
Published 15 Jul 2021 · NVD - Medium 5.3
CVE-2021-34429 · Eclipse Jetty
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Published 15 Jul 2021 · Fixed in 9.4.43, 10.0.6, 11.0.6 · NVD - Medium 6.5
CVE-2021-27847 · libvips
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85.
Published 15 Jul 2021 · NVD - High 8.8
CVE-2021-31999 · Rancher
Privilege escalation vulnerability via malicious "Connection" header
Published 15 Jul 2021 · Fixed in 2.4.16, 2.5.9 · NVD, Project advisories (GitHub) - Critical 9.9
CVE-2021-25320 · Rancher
Cloud credentials can be used through proxy API by users without access
Published 15 Jul 2021 · Fixed in 2.4.16, 2.5.9 · NVD, Project advisories (GitHub) - High 8.8
CVE-2021-25318 · Rancher
ApiGroup not properly specified when creating Kubernetes RBAC resources
Published 15 Jul 2021 · Fixed in 2.4.16, 2.5.9 · NVD, Project advisories (GitHub) - Unrated
WPV-92bb33ae3064 · WooCommerce
Vulnerability in WooCommerce
Published 15 Jul 2021 · Fixed in 5.5.1 · WPVulnerability - Critical 10.0Actively exploited
CVE-2021-35211 · SolarWinds Serv-U
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
Published 14 Jul 2021 · Fixed in 15.2.3 · NVD - Critical 9.0Actively exploited
CVE-2021-34523 · Microsoft Exchange Server
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published 14 Jul 2021 · NVD - Critical 9.1Actively exploited
CVE-2021-34473 · Microsoft Exchange Server
Microsoft Exchange Server Remote Code Execution Vulnerability
Published 14 Jul 2021 · NVD - High 8.0
CVE-2021-34470 · Microsoft Exchange Server
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published 14 Jul 2021 · NVD - High 8.0
CVE-2021-33768 · Microsoft Exchange Server
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published 14 Jul 2021 · NVD - High 7.3Actively exploited
CVE-2021-33766 · Microsoft Exchange Server
Microsoft Exchange Server Information Disclosure Vulnerability
Published 14 Jul 2021 · NVD - High 7.6
CVE-2021-31206 · Microsoft Exchange Server
Microsoft Exchange Server Remote Code Execution Vulnerability
Published 14 Jul 2021 · NVD - High 7.2Actively exploited
CVE-2021-31196 · Microsoft Exchange Server
Microsoft Exchange Server Remote Code Execution Vulnerability
Published 14 Jul 2021 · NVD - Medium 6.5
CVE-2021-36740 · Varnish Cache
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
Published 14 Jul 2021 · NVD - Medium 6.5
CVE-2020-20231 · MikroTik RouterOS
Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
Published 14 Jul 2021 · NVD - High 7.5
CVE-2021-21995 · VMware ESXi
OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi may be able to trigger a heap out-of-bounds read in OpenSLP service resulting in a denial-of-service condition.
Published 13 Jul 2021 · NVD - Critical 9.8
CVE-2021-21994 · VMware ESXi
SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB authentication by sending a specially crafted request.
Published 13 Jul 2021 · NVD - Medium 6.5
CVE-2020-20252 · MikroTik RouterOS
Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
Published 13 Jul 2021 · Fixed in 6.47 · NVD - Medium 5.8
CVE-2021-31810 · Ruby
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
Published 13 Jul 2021 · NVD - Medium 6.5
CVE-2020-20250 · MikroTik RouterOS
Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference). NOTE: this is different from CVE-2020-20253 and CVE-2020-20254. All four vulnerabilities in the /nova/bin/lcdstat process are discussed in the CVE-2020-20250 github.com/cq674350529…
Published 13 Jul 2021 · Fixed in 6.47 · NVD - Medium 4.9
CVE-2021-32790 · WooCommerce
WooCommerce: SQL Injection
Published 13 Jul 2021 · Fixed in 5.4.2, 5.5.1, 6.6.0 · NVD, WPVulnerability - Medium 5.3
CVE-2021-32741 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD - Medium 5.3
CVE-2021-32734 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud…
Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD - Medium 6.1
CVE-2021-32733 · Nextcloud
Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable…
Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD - Critical 9.8
CVE-2021-32726 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD - Medium 5.3
CVE-2021-32725 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD - High 7.5
CVE-2021-32705 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD - Medium 5.3
CVE-2021-32703 · Nextcloud
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD - Medium 5.4
CVE-2020-19203 · pfSense
An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr (description) parameter of wake-on-LAN entries in its output, leading to a possible stored XSS.
Published 12 Jul 2021 · Fixed in 2.4.4 · NVD - Medium 5.4
CVE-2020-19201 · pfSense
A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr (description) parameter on NAT rules.
Published 12 Jul 2021 · NVD - Medium 5.3
CVE-2021-33037 · Apache Tomcat
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured…
Published 12 Jul 2021 · NVD - Medium 6.5
CVE-2021-30640 · Apache Tomcat
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
Published 12 Jul 2021 · Fixed in 8.5.66, 9.0.46, 10.0.6 · NVD - High 7.5
CVE-2021-30639 · Apache Tomcat
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail.…
Published 12 Jul 2021 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.