UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,118
Published in 7 days
684
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,118 vulnerabilities
  1. High 8.8

    CVE-2021-32688 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own…

    Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD
  2. Low 3.3

    CVE-2021-32680 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3.

    Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD
  3. High 8.8

    CVE-2021-32679 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in controllers using `DownloadResponse`. When a user-supplied filename was passed unsanitized into a `DownloadResponse`, this could be used to trick users into downloading malicious files with a benign file extension. This would show in UI…

    Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD
  4. Medium 5.3

    CVE-2021-32678 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or…

    Published 12 Jul 2021 · Fixed in 19.0.13, 20.0.11, 21.0.3 · NVD
  5. High 7.4

    CVE-2021-3547 · OpenVPN

    OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration.

    Published 12 Jul 2021 · NVD
  6. High 7.8

    CVE-2021-22921 · Node.js

    Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

    Published 12 Jul 2021 · Fixed in 12.22.2, 14.17.2, 16.4.1 · NVD
  7. Medium 5.3

    CVE-2021-22918 · Node.js

    Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

    Published 12 Jul 2021 · Fixed in 12.22.2, 14.17.2, 16.4.1 · NVD
  8. Unrated

    WPV-7f8882fa1949 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 12 Jul 2021 · Fixed in 1.16.59 · WPVulnerability
  9. Unrated

    WPV-4fbde90bf1ca · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 12 Jul 2021 · Fixed in 1.16.59 · WPVulnerability
  10. Medium 5.3

    CVE-2020-29014 · Fortinet FortiSandbox

    A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands.

    Published 9 Jul 2021 · Fixed in 3.2.2 · NVD
  11. Medium 6.5

    CVE-2021-3541 · libxml2

    A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

    Published 9 Jul 2021 · Fixed in 2.9.11 · NVD
  12. High 8.8

    CVE-2021-23405 · Pimcore

    This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

    Published 9 Jul 2021 · Fixed in 10.0.7 · NVD
  13. Medium 6.5

    CVE-2020-20217 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

    Published 8 Jul 2021 · Fixed in 6.47 · NVD
  14. Medium 4.3

    CVE-2021-22233 · GitLab

    An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details

    Published 7 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  15. Medium 6.5

    CVE-2020-20225 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.

    Published 7 Jul 2021 · Fixed in 6.47 · NVD
  16. Medium 6.5

    CVE-2020-20216 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 7 Jul 2021 · NVD
  17. Medium 6.5

    CVE-2020-20215 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.

    Published 7 Jul 2021 · NVD
  18. Medium 6.5

    CVE-2020-20213 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

    Published 7 Jul 2021 · NVD
  19. Medium 6.5

    CVE-2020-20212 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 7 Jul 2021 · NVD
  20. Medium 6.5

    CVE-2020-20211 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.

    Published 7 Jul 2021 · NVD
  21. Medium 5.4

    CVE-2021-22225 · GitLab

    Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

    Published 7 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  22. Medium 6.5

    CVE-2021-22224 · GitLab

    A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim

    Published 7 Jul 2021 · Fixed in 13.12.6, 14.0.2 · NVD
  23. Medium 6.1

    CVE-2021-26039 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.

    Published 7 Jul 2021 · NVD
  24. High 7.5

    CVE-2021-26038 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for com_installer is limited to super users already.

    Published 7 Jul 2021 · NVD
  25. Medium 5.3

    CVE-2021-26037 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.

    Published 7 Jul 2021 · NVD
  26. High 7.5

    CVE-2021-26036 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table.

    Published 7 Jul 2021 · NVD
  27. Medium 6.1

    CVE-2021-26035 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.

    Published 7 Jul 2021 · NVD
  28. Medium 4.3

    CVE-2021-22231 · GitLab

    A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username.

    Published 7 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  29. High 7.2

    CVE-2021-22230 · GitLab

    Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2.

    Published 7 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  30. Medium 6.1

    CVE-2021-22227 · GitLab

    A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it

    Published 7 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  31. Medium 6.5

    CVE-2021-22228 · GitLab

    An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql.

    Published 6 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  32. Medium 6.1

    CVE-2021-22223 · GitLab

    Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link

    Published 6 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  33. Medium 5.4

    CVE-2021-22232 · GitLab

    HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE

    Published 6 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  34. High 7.5

    CVE-2021-22229 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal repository through project fork done by a project member.

    Published 6 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  35. Medium 6.5

    CVE-2021-22226 · GitLab

    Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9

    Published 6 Jul 2021 · Fixed in 13.11.6, 13.12.6, 14.0.2 · NVD
  36. Medium 6.1

    CVE-2021-32233 · SmarterMail

    SmarterTools SmarterMail before Build 7776 allows XSS.

    Published 6 Jul 2021 · Fixed in 16.3.7776 · NVD
  37. High 7.5

    CVE-2020-26763 · Rocket.Chat

    The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.

    Published 5 Jul 2021 · NVD
  38. Critical 9.8

    CVE-2021-35209 · Zimbra Collaboration

    An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting).

    Published 2 Jul 2021 · Fixed in 8.8.15 · NVD
  39. Medium 5.4

    CVE-2021-35208 · Zimbra Collaboration

    An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

    Published 2 Jul 2021 · Fixed in 8.8.15 · NVD
  40. Medium 6.1

    CVE-2021-35207 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.

    Published 2 Jul 2021 · Fixed in 8.8.15 · NVD
  41. Medium 6.1

    CVE-2021-34807 · Zimbra Collaboration

    An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL via isredirect=1&redirectURL= in conjunction with the token data (e.g., a valid authtoken= value).

    Published 2 Jul 2021 · Fixed in 8.8.15 · NVD
  42. High 7.8

    CVE-2021-3606 · OpenVPN

    OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).

    Published 2 Jul 2021 · Fixed in 2.5.3 · NVD
  43. High 8.8

    CVE-2021-36132 · MediaWiki

    An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variable, it might not validate all appropriate user rights, thus allowing a user with insufficient rights to perform operations (specifically file uploads) that they should not be allowed to perform.

    Published 2 Jul 2021 · NVD
  44. Medium 4.8

    CVE-2021-36131 · MediaWiki

    An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML and JavaScript within various data fields. The attack could easily propagate across many pages for many users.

    Published 2 Jul 2021 · NVD
  45. Medium 4.8

    CVE-2021-36130 · MediaWiki

    An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.

    Published 2 Jul 2021 · NVD
  46. Medium 4.3

    CVE-2021-36129 · MediaWiki

    An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata.

    Published 2 Jul 2021 · NVD
  47. Critical 9.8

    CVE-2021-36128 · MediaWiki

    An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppression blocks are not properly implemented.

    Published 2 Jul 2021 · NVD
  48. Medium 4.3

    CVE-2021-36127 · MediaWiki

    An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosing suppressed accounts (which are supposed to be completely hidden).

    Published 2 Jul 2021 · NVD
  49. Critical 9.8

    CVE-2021-36126 · MediaWiki

    An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user.

    Published 2 Jul 2021 · NVD
  50. High 7.5

    CVE-2021-36125 · MediaWiki

    An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial of service attacks when a user's current username is beyond an arbitrary maximum configuration value (MaxNameChars).

    Published 2 Jul 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.