UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,118
Published in 7 days
684
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,118 vulnerabilities
  1. High 7.5

    CVE-2021-35197 · MediaWiki

    In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).

    Published 2 Jul 2021 · Fixed in 1.31.15, 1.35.3, 1.36.1 · NVD
  2. Medium 5.4

    CVE-2021-32735 · Kirby

    Cross-site scripting (XSS) from field and configuration text displayed in the Panel

    Published 2 Jul 2021 · Fixed in 3.5.7 · NVD, Project advisories (GitHub)
  3. High 7.5

    CVE-2021-21671 · Jenkins

    Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.

    Published 30 Jun 2021 · Fixed in 2.289.2, 2.300 · NVD
  4. Medium 4.3

    CVE-2021-21670 · Jenkins

    Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.

    Published 30 Jun 2021 · Fixed in 2.289.2, 2.300 · NVD
  5. Critical 9.8

    CVE-2021-35971 · Veeam Backup & Replication

    Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.

    Published 30 Jun 2021 · Fixed in 10.0.1.4854, 11.0.0.837 · NVD
  6. Critical 9.8

    CVE-2021-27903 · Craft CMS

    An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).

    Published 30 Jun 2021 · Fixed in 3.6.7 · NVD
  7. Medium 6.1

    CVE-2021-27902 · Craft CMS

    An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.

    Published 30 Jun 2021 · Fixed in 3.6.0 · NVD
  8. Medium 5.5

    CVE-2021-28693 · Xen

    xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm.

    Published 30 Jun 2021 · NVD
  9. High 7.1

    CVE-2021-28692 · Xen

    inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try…

    Published 30 Jun 2021 · NVD
  10. Critical 9.8

    CVE-2021-35474 · Apache Traffic Server

    Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

    Published 30 Jun 2021 · NVD
  11. High 7.5

    CVE-2021-32567 · Apache Traffic Server

    Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

    Published 30 Jun 2021 · NVD
  12. High 7.5

    CVE-2021-32566 · Apache Traffic Server

    Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

    Published 30 Jun 2021 · NVD
  13. High 7.5

    CVE-2021-32565 · Apache Traffic Server

    Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

    Published 29 Jun 2021 · NVD
  14. Medium 6.5

    CVE-2021-28690 · Xen

    x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend.

    Published 29 Jun 2021 · NVD
  15. High 7.5

    CVE-2021-27577 · Apache Traffic Server

    Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

    Published 29 Jun 2021 · NVD
  16. Medium 5.3

    CVE-2021-32720 · Sylius

    Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This…

    Published 28 Jun 2021 · Fixed in 1.9.5 · NVD
  17. Medium 6.1

    CVE-2020-22607 · LimeSurvey

    Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.

    Published 28 Jun 2021 · NVD
  18. Medium 6.1

    CVE-2021-34254 · Umbraco CMS

    Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx.

    Published 28 Jun 2021 · Fixed in 7.15.7 · NVD
  19. Medium 5.4

    CVE-2020-23710 · LimeSurvey

    Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.

    Published 28 Jun 2021 · NVD
  20. Medium 5.3

    CVE-2021-28585 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.

    Published 28 Jun 2021 · Fixed in 2.3.6 · NVD
  21. High 7.2

    CVE-2021-28584 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.

    Published 28 Jun 2021 · Fixed in 2.3.6 · NVD
  22. Medium 4.2

    CVE-2021-28583 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.

    Published 28 Jun 2021 · Fixed in 2.3.6 · NVD
  23. Medium 6.5

    CVE-2021-28563 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    Published 28 Jun 2021 · Fixed in 2.3.7 · NVD
  24. Medium 4.8

    CVE-2021-28556 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.

    Published 28 Jun 2021 · Fixed in 2.3.7 · NVD
  25. Medium 6.1

    CVE-2021-21084 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 28 Jun 2021 · Fixed in 6.4.8.4, 6.5.8.0 · NVD
  26. High 7.5

    CVE-2021-21083 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the current user.

    Published 28 Jun 2021 · Fixed in 6.4.8.4, 6.5.8.0 · NVD
  27. Medium 4.8

    CVE-2021-33515 · Dovecot

    The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

    Published 28 Jun 2021 · Fixed in 2.3.14.1 · NVD
  28. Medium 4.3

    CVE-2020-28200 · Dovecot

    The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.

    Published 28 Jun 2021 · Fixed in 2.3.15 · NVD
  29. Medium 5.5

    CVE-2021-29157 · Dovecot

    Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.

    Published 28 Jun 2021 · Fixed in 2.3.14.1 · NVD
  30. Medium 6.1

    CVE-2021-24452 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 28 Jun 2021 · Fixed in 2.1.5 · WPVulnerability
  31. Medium 6.1

    CVE-2021-24436 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 28 Jun 2021 · Fixed in 2.1.4 · WPVulnerability
  32. Medium 4.8

    CVE-2021-32719 · RabbitMQ

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin

    Published 27 Jun 2021 · Fixed in 3.8.18 · NVD, Project advisories (GitHub)
  33. Medium 5.4

    CVE-2021-32718 · RabbitMQ

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI

    Published 27 Jun 2021 · Fixed in 3.8.17 · NVD, Project advisories (GitHub)
  34. Medium 4.8

    CVE-2021-32713 · Shopware

    Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.

    Published 24 Jun 2021 · Fixed in 5.6.10 · NVD
  35. Medium 5.3

    CVE-2021-32712 · Shopware

    Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.

    Published 24 Jun 2021 · Fixed in 5.6.10 · NVD
  36. Medium 5.4

    CVE-2020-18671 · Roundcube

    Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.

    Published 24 Jun 2021 · NVD
  37. Medium 5.4

    CVE-2020-18670 · Roundcube

    Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.

    Published 24 Jun 2021 · NVD
  38. Medium

    GHSA-243q-g9j3-qf6r · Shopware

    non-admin users can create integration role with administrator role

    Published 24 Jun 2021 · Fixed in 6.4.1.1 · Project advisories (GitHub)
  39. Medium 4.9

    CVE-2021-32716 · Shopware

    Internal hidden fields are visible on to many associations in admin api

    Published 24 Jun 2021 · Fixed in 6.4.1.1 · NVD, Project advisories (GitHub)
  40. High 7.5

    CVE-2021-32717 · Shopware

    Private files publicly accessible with Cloud Storage providers

    Published 24 Jun 2021 · Fixed in 6.4.1.1 · NVD, Project advisories (GitHub)
  41. Medium

    GHSA-wq3r-jwrq-xg6w · Shopware

    Canceling of orders not related to the logged-in user

    Published 24 Jun 2021 · Fixed in 6.4.1.1 · Project advisories (GitHub)
  42. Medium 4.9

    CVE-2021-32709 · Shopware

    Creation of order credits was not validated by acl in admin orders

    Published 24 Jun 2021 · Fixed in 6.4.1.1 · NVD, Project advisories (GitHub)
  43. Low 3.7

    CVE-2021-32823 · GitLab

    In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the…

    Published 24 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  44. Critical 9.1

    CVE-2021-21809 · Moodle

    A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

    Published 23 Jun 2021 · NVD
  45. High 7.5

    CVE-2021-20019 · SonicWall SonicOS

    A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.

    Published 23 Jun 2021 · Fixed in 7.0.0.376, 7.0.1-r1036 · NVD
  46. Medium 6.1

    CVE-2021-35210 · Contao

    Cross-site scripting in the system log

    Published 23 Jun 2021 · Fixed in 4.9.16, 4.11.5 · NVD, Project advisories (GitHub)
  47. Low 3.5

    CVE-2021-34428 · Eclipse Jetty

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

    Published 22 Jun 2021 · NVD
  48. Critical 9.8

    CVE-2010-1435 · Joomla!

    Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

    Published 21 Jun 2021 · NVD
  49. High 7.5

    CVE-2010-1434 · Joomla!

    Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

    Published 21 Jun 2021 · NVD
  50. Critical 9.8

    CVE-2010-1433 · Joomla!

    Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. Joomla! Core versions…

    Published 21 Jun 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.