UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,118
Published in 7 days
684
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,118 vulnerabilities
  1. High 7.5

    CVE-2010-1432 · Joomla!

    Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

    Published 21 Jun 2021 · NVD
  2. Medium 4.3

    CVE-2021-34553 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.

    Published 18 Jun 2021 · Fixed in 3.31.0 · NVD
  3. Medium 5.4

    CVE-2021-24365 · Codepress Admin Columns (WordPress plugin)

    Admin Columns: Cross-site Scripting

    Published 18 Jun 2021 · Fixed in 4.3.2 · WPVulnerability
  4. High

    CVE-2021-32693 · Symfony

    Authentication granted to all firewalls instead of just one

    Published 17 Jun 2021 · Fixed in 5.3.2 · Project advisories (GitHub)
  5. High 8.1

    CVE-2021-3603 · PHPMailer

    PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in…

    Published 17 Jun 2021 · NVD
  6. Medium 5.4

    CVE-2021-32681 · Wagtail

    Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

    Published 17 Jun 2021 · Fixed in 2.11.8 · NVD, Project advisories (GitHub)
  7. Medium 5.4

    CVE-2021-32244 · Moodle

    Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.

    Published 16 Jun 2021 · NVD
  8. High 8.1

    CVE-2021-34551 · PHPMailer

    PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.

    Published 16 Jun 2021 · Fixed in 6.5.0 · NVD
  9. Medium 6.5

    CVE-2020-8300 · NetScaler ADC and Gateway

    Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

    Published 16 Jun 2021 · Fixed in 11.1-65.20 · NVD
  10. Medium 6.5

    CVE-2020-8299 · NetScaler ADC and Gateway

    Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. Note that the attacker must be in the same…

    Published 16 Jun 2021 · Fixed in 11.1-65.20 · NVD
  11. High 7.5

    CVE-2021-33813 · Apache Solr

    An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

    Published 16 Jun 2021 · NVD
  12. Critical 9.8

    CVE-2020-9493 · Apache Log4j

    A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.

    Published 16 Jun 2021 · Fixed in 2.0 · NVD
  13. High 7.5

    CVE-2021-31618 · Apache HTTP Server

    Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2…

    Published 15 Jun 2021 · NVD
  14. High 7.5

    CVE-2021-20027 · SonicWall SonicOS

    A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.

    Published 14 Jun 2021 · NVD
  15. Medium 5.5

    CVE-2021-32553 · Java

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.

    Published 12 Jun 2021 · NVD
  16. Critical 9.8

    CVE-2021-22915 · Nextcloud

    Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection.

    Published 11 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD
  17. High 8.1

    CVE-2021-22901 · curl, MySQL

    curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL,…

    Published 11 Jun 2021 · NVD
  18. Low 3.1

    CVE-2021-22898 · curl, MySQL

    curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing…

    Published 11 Jun 2021 · Fixed in 5.7.34, 8.0.25 · NVD
  19. Medium 5.3

    CVE-2021-22897 · curl, MySQL

    curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets…

    Published 11 Jun 2021 · NVD
  20. Medium 6.5

    CVE-2021-22181 · GitLab

    A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources.

    Published 11 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  21. Critical 9.8Actively exploited

    CVE-2021-22175 · GitLab

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

    Published 11 Jun 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  22. High 8.8

    CVE-2020-13663 · Drupal

    Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

    Published 11 Jun 2021 · Fixed in 8.8.8, 8.9.1, 9.0.1 · NVD
  23. High 8.8

    CVE-2021-29754 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association Interceptor (TAI). IBM X-Force ID: 202006.

    Published 11 Jun 2021 · Fixed in 8.0.0.15, 8.5.5.20, 9.0.5.8 · NVD
  24. Medium 5.5

    CVE-2021-28689 · Xen

    x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring…

    Published 11 Jun 2021 · Fixed in 4.12.0 · NVD
  25. Medium 5.5

    CVE-2021-28687 · Xen

    HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't…

    Published 11 Jun 2021 · NVD
  26. Medium 6.1

    CVE-2020-13688 · Drupal

    Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

    Published 11 Jun 2021 · Fixed in 8.8.10, 8.9.6, 9.0.6 · NVD
  27. High 7.8

    CVE-2021-23022 · F5 BIG-IP

    On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Jun 2021 · NVD
  28. High 7.8

    CVE-2021-23023 · F5 BIG-IP

    On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Jun 2021 · Fixed in 7.2.1.3 · NVD
  29. Medium 5.3

    CVE-2021-30641 · Apache HTTP Server

    Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

    Published 10 Jun 2021 · NVD
  30. Critical 9.8

    CVE-2021-26691 · Apache HTTP Server

    In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

    Published 10 Jun 2021 · NVD
  31. High 7.5

    CVE-2021-26690 · Apache HTTP Server

    Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

    Published 10 Jun 2021 · NVD
  32. High 7.3

    CVE-2020-35452 · Apache HTTP Server

    Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero…

    Published 10 Jun 2021 · NVD
  33. High 7.5

    CVE-2020-13950 · Apache HTTP Server

    Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

    Published 10 Jun 2021 · NVD
  34. Medium 5.5

    CVE-2020-13938 · Apache HTTP Server

    Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows

    Published 10 Jun 2021 · NVD
  35. Medium 5.3

    CVE-2019-17567 · Apache HTTP Server

    Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

    Published 10 Jun 2021 · NVD
  36. High 8.8

    CVE-2021-33894 · MOVEit Transfer

    In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain…

    Published 9 Jun 2021 · Fixed in 2020.0.5, 2020.1.4, 2021.0.1 · NVD
  37. Medium 6.1

    CVE-2021-29049 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.

    Published 9 Jun 2021 · NVD
  38. Medium 6.1

    CVE-2021-33829 · Drupal

    A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

    Published 9 Jun 2021 · Fixed in 8.9.16, 9.0.14, 9.1.9 · NVD
  39. Medium 5.5

    CVE-2021-26314 · Xen

    Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.

    Published 9 Jun 2021 · NVD
  40. Medium 5.5

    CVE-2021-26313 · Xen

    Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.

    Published 9 Jun 2021 · NVD
  41. Medium 5.3

    CVE-2021-28169 · Eclipse Jetty

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

    Published 9 Jun 2021 · Fixed in 9.4.41, 10.0.3, 11.0.3 · NVD
  42. Medium 5.9

    CVE-2021-31957 · .NET

    ASP.NET Core Denial of Service Vulnerability

    Published 8 Jun 2021 · NVD
  43. Medium 6.5

    CVE-2021-31807 · Squid

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.

    Published 8 Jun 2021 · Fixed in 4.15, 5.0.6 · NVD
  44. Medium 5.4

    CVE-2021-22220 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks.

    Published 8 Jun 2021 · NVD
  45. Medium 6.5

    CVE-2021-22216 · GitLab

    A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description

    Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  46. Medium 6.5

    CVE-2020-26136 · Silverstripe CMS

    In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.

    Published 8 Jun 2021 · Fixed in 4.6.0 · NVD
  47. Medium 6.5

    CVE-2021-22221 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired

    Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  48. Medium 4.9

    CVE-2021-22219 · GitLab

    All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking.

    Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  49. Medium 6.5

    CVE-2021-22217 · GitLab

    A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request

    Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  50. Medium 6.5

    CVE-2021-22213 · GitLab

    A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari

    Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.