UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,118
Published in 7 days
684
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,118 vulnerabilities
  1. Medium 5.3

    CVE-2020-26138 · Silverstripe CMS

    In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.

    Published 8 Jun 2021 · Fixed in 4.6.0 · NVD
  2. Medium 4.8

    CVE-2020-25817 · Silverstripe CMS

    SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom…

    Published 8 Jun 2021 · Fixed in 4.6.0 · NVD
  3. Low 2.6

    CVE-2021-22218 · GitLab

    All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits.

    Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  4. Low 2.7

    CVE-2021-22215 · GitLab

    An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects

    Published 8 Jun 2021 · Fixed in 13.11.5, 13.12.2 · NVD
  5. High 8.6

    CVE-2021-22214 · GitLab

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited

    Published 8 Jun 2021 · Fixed in 13.10.5, 13.11.5, 13.12.2 · NVD
  6. High 7.5

    CVE-2021-22116 · RabbitMQ

    RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.

    Published 8 Jun 2021 · Fixed in 3.8.16 · NVD
  7. Medium 6.1

    CVE-2021-26080 · Jira

    EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

    Published 7 Jun 2021 · Fixed in 8.5.14, 8.13.6, 8.16.1 · NVD
  8. Medium 6.1

    CVE-2021-26079 · Jira

    The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

    Published 7 Jun 2021 · Fixed in 8.5.15, 8.13.7, 8.17.0 · NVD
  9. Medium 6.1

    CVE-2021-26078 · Jira

    The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

    Published 7 Jun 2021 · Fixed in 8.5.14, 8.13.6, 8.16.1 · NVD
  10. High 7.2

    CVE-2021-3277 · Nagios XI

    Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.

    Published 7 Jun 2021 · NVD
  11. Medium 5.3

    CVE-2021-29621 · Apache Airflow

    Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.

    Published 7 Jun 2021 · NVD
  12. Critical 9.8

    CVE-2017-20005 · nginx

    NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.

    Published 6 Jun 2021 · Fixed in 1.13.6 · NVD
  13. High 8.8

    CVE-2021-33815 · FFmpeg

    dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.

    Published 3 Jun 2021 · NVD
  14. High 7.4

    CVE-2021-32923 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

    Published 3 Jun 2021 · Fixed in 1.5.9, 1.6.5, 1.7.2 · NVD
  15. Medium 4.9

    CVE-2021-22130 · Fortinet FortiProxy

    A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an authenticated, remote attacker to perform a Denial of Service attack by running the `diagnose sys cpuset` with a large cpuset mask value. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code…

    Published 3 Jun 2021 · Fixed in 1.2.10, 2.0.2 · NVD
  16. Medium 6.5

    CVE-2020-22056 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the config_input function in af_acrossover.c.

    Published 2 Jun 2021 · NVD
  17. Medium 6.5

    CVE-2020-22054 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c.

    Published 2 Jun 2021 · NVD
  18. Medium 6.5

    CVE-2020-22051 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filter_frame function in vf_tile.c.

    Published 2 Jun 2021 · NVD
  19. Medium 6.5

    CVE-2020-22049 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c.

    Published 2 Jun 2021 · NVD
  20. Medium 6.5

    CVE-2020-22048 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c.

    Published 2 Jun 2021 · NVD
  21. Medium 6.5

    CVE-2020-22046 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c.

    Published 2 Jun 2021 · NVD
  22. Medium 5.5

    CVE-2021-3522 · Java

    GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.

    Published 2 Jun 2021 · NVD
  23. High 7.3

    CVE-2021-24012 · Fortinet FortiOS

    An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted Certificate Authority.

    Published 2 Jun 2021 · Fixed in 6.4.5 · NVD
  24. Medium 4.3

    CVE-2021-32657 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use…

    Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD
  25. High 8.6

    CVE-2021-32656 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other…

    Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD
  26. Low 3.5

    CVE-2021-32655 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently…

    Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD
  27. Critical 9.1

    CVE-2021-32654 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround,…

    Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD
  28. Medium 6.5

    CVE-2020-22044 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c.

    Published 1 Jun 2021 · NVD
  29. Low 2.7

    CVE-2021-32653 · Nextcloud

    Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist.

    Published 1 Jun 2021 · Fixed in 19.0.11, 20.0.10, 21.0.2 · NVD
  30. High 8.8

    CVE-2021-22123 · Fortinet FortiWeb

    An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page.

    Published 1 Jun 2021 · Fixed in 6.2.4, 6.3.8 · NVD
  31. Medium 6.5

    CVE-2020-22043 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c.

    Published 1 Jun 2021 · NVD
  32. Medium 6.5

    CVE-2020-22042 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function in libavfilter/graphparser.c.

    Published 1 Jun 2021 · NVD
  33. Medium 6.5

    CVE-2020-22041 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc.

    Published 1 Jun 2021 · NVD
  34. Medium 6.5

    CVE-2020-22040 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.

    Published 1 Jun 2021 · NVD
  35. Medium 6.5

    CVE-2020-22039 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.

    Published 1 Jun 2021 · NVD
  36. Medium 6.5

    CVE-2020-22038 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c.

    Published 1 Jun 2021 · NVD
  37. Medium 6.5

    CVE-2020-22037 · FFmpeg

    A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.

    Published 1 Jun 2021 · NVD
  38. High 8.8

    CVE-2020-22036 · FFmpeg

    A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other potential consequences.

    Published 1 Jun 2021 · NVD
  39. High 8.8

    CVE-2020-22035 · FFmpeg

    A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences.

    Published 1 Jun 2021 · NVD
  40. High 7.5

    CVE-2021-32625 · Redis

    Vulnerability in STRALGO LCS

    Published 1 Jun 2021 · Fixed in 6.0.14 · Project advisories (GitHub)
  41. High 8.8

    CVE-2021-32027 · PostgreSQL

    A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

    Published 1 Jun 2021 · Fixed in 11.12, 12.7, 13.3 · NVD
  42. High 7.7

    CVE-2021-23017 · nginx, OpenResty

    A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

    Published 1 Jun 2021 · Fixed in 1.19.3.2, 1.20.1 · NVD
  43. Medium 5.3

    CVE-2021-24374 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Authorization Bypass Through User-Controlled Key

    Published 1 Jun 2021 · Fixed in 9.8 · NVD, WPVulnerability
  44. Medium 5.4

    CVE-2021-24366 · Codepress Admin Columns (WordPress plugin)

    Admin Columns: Cross-site Scripting

    Published 31 May 2021 · Fixed in 4.3 · WPVulnerability
  45. High 8.3

    CVE-2021-29492 · Envoy

    Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker…

    Published 28 May 2021 · Fixed in 1.16.4, 1.17.3, 1.18.3 · NVD
  46. High 7.8

    CVE-2020-10145 · Adobe ColdFusion

    The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.

    Published 27 May 2021 · NVD
  47. Critical 9.0

    CVE-2020-15180 · MariaDB

    A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before…

    Published 27 May 2021 · Fixed in 10.3.25, 10.4.15, 10.5.6 · NVD
  48. High 7.4

    CVE-2020-14387 · rsync

    A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this…

    Published 27 May 2021 · Fixed in 3.2.4 · NVD
  49. High 8.8

    CVE-2020-22034 · FFmpeg

    A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memory corruption and other potential consequences.

    Published 27 May 2021 · NVD
  50. Medium 6.5

    CVE-2020-22033 · FFmpeg

    A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, which could let a remote malicious user cause a Denial of Service.

    Published 27 May 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.