Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,138
- Published in 7 days
- 704
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,138 vulnerabilities- Medium 6.5
CVE-2020-22043 · FFmpeg
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c.
Published 1 Jun 2021 · NVD - Medium 6.5
CVE-2020-22042 · FFmpeg
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function in libavfilter/graphparser.c.
Published 1 Jun 2021 · NVD - Medium 6.5
CVE-2020-22041 · FFmpeg
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc.
Published 1 Jun 2021 · NVD - Medium 6.5
CVE-2020-22040 · FFmpeg
A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.
Published 1 Jun 2021 · NVD - Medium 6.5
CVE-2020-22039 · FFmpeg
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.
Published 1 Jun 2021 · NVD - Medium 6.5
CVE-2020-22038 · FFmpeg
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c.
Published 1 Jun 2021 · NVD - Medium 6.5
CVE-2020-22037 · FFmpeg
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.
Published 1 Jun 2021 · NVD - High 8.8
CVE-2020-22036 · FFmpeg
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other potential consequences.
Published 1 Jun 2021 · NVD - High 8.8
CVE-2020-22035 · FFmpeg
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences.
Published 1 Jun 2021 · NVD - High 7.5
CVE-2021-32625 · Redis
Vulnerability in STRALGO LCS
Published 1 Jun 2021 · Fixed in 6.0.14 · Project advisories (GitHub) - High 8.8
CVE-2021-32027 · PostgreSQL
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Published 1 Jun 2021 · Fixed in 11.12, 12.7, 13.3 · NVD - High 7.7
CVE-2021-23017 · nginx, OpenResty
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
Published 1 Jun 2021 · Fixed in 1.19.3.2, 1.20.1 · NVD - Medium 5.3
CVE-2021-24374 · Jetpack
Jetpack – WP Security, Backup, Speed, & Growth: Authorization Bypass Through User-Controlled Key
Published 1 Jun 2021 · Fixed in 9.8 · NVD, WPVulnerability - Medium 5.4
CVE-2021-24366 · Codepress Admin Columns (WordPress plugin)
Admin Columns: Cross-site Scripting
Published 31 May 2021 · Fixed in 4.3 · WPVulnerability - High 8.3
CVE-2021-29492 · Envoy
Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker…
Published 28 May 2021 · Fixed in 1.16.4, 1.17.3, 1.18.3 · NVD - High 7.8
CVE-2020-10145 · Adobe ColdFusion
The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a privilege-escalation vulnerability.
Published 27 May 2021 · NVD - Critical 9.0
CVE-2020-15180 · MariaDB
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before…
Published 27 May 2021 · Fixed in 10.3.25, 10.4.15, 10.5.6 · NVD - High 7.4
CVE-2020-14387 · rsync
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this…
Published 27 May 2021 · Fixed in 3.2.4 · NVD - High 8.8
CVE-2020-22034 · FFmpeg
A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - Medium 6.5
CVE-2020-22033 · FFmpeg
A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, which could let a remote malicious user cause a Denial of Service.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22032 · FFmpeg
A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22027 · FFmpeg
A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22025 · FFmpeg
A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22023 · FFmpeg
A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22022 · FFmpeg
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22017 · FFmpeg
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22016 · FFmpeg
A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22031 · FFmpeg
A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22030 · FFmpeg
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - High 8.8
CVE-2020-22029 · FFmpeg
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.
Published 27 May 2021 · NVD - Medium 6.5
CVE-2021-31808 · Squid
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.
Published 27 May 2021 · Fixed in 4.15, 5.0.6 · NVD - Medium 6.5
CVE-2021-31806 · Squid
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.
Published 27 May 2021 · Fixed in 4.15, 5.0.6 · NVD - Critical 9.8
CVE-2021-22911 · Rocket.Chat
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
Published 27 May 2021 · NVD - High 8.8
CVE-2021-22908 · Ivanti Connect Secure
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.
Published 27 May 2021 · NVD - High 7.2Actively exploited
CVE-2021-22900 · Ivanti Connect Secure
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Published 27 May 2021 · NVD - High 8.8Actively exploited
CVE-2021-22899 · Ivanti Connect Secure
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
Published 27 May 2021 · NVD - High 8.8Actively exploited
CVE-2021-22894 · Ivanti Connect Secure
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
Published 27 May 2021 · NVD - High 7.5
CVE-2021-22892 · Rocket.Chat
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.
Published 27 May 2021 · Fixed in 3.11.3, 3.12.2 · NVD - Medium 6.1
CVE-2021-3486 · GLPI
GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.
Published 26 May 2021 · NVD - Medium 5.3
CVE-2021-28170 · Oracle WebLogic Server
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Published 26 May 2021 · NVD - Medium 6.5
CVE-2020-22028 · FFmpeg
Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service.
Published 26 May 2021 · NVD - Medium 6.5
CVE-2020-22026 · FFmpeg
Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which could let a remote malicious user cause a Denial of Service.
Published 26 May 2021 · NVD - Medium 6.5
CVE-2020-22024 · FFmpeg
Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfun_frame16 function in libavfilter/vf_lagfun.c, which could let a remote malicious user cause Denial of Service.
Published 26 May 2021 · NVD - Medium 6.5
CVE-2020-22021 · FFmpeg
Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Service.
Published 26 May 2021 · NVD - Medium 6.5
CVE-2020-22020 · FFmpeg
Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Denial of Service.
Published 26 May 2021 · NVD - Medium 6.5
CVE-2020-22019 · FFmpeg
Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Service.
Published 26 May 2021 · NVD - High 8.2
CVE-2021-20492 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.
Published 26 May 2021 · NVD - High 8.8
CVE-2020-22015 · FFmpeg
Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user obtain sensitive information, cause a Denial of Service, or execute arbitrary code.
Published 26 May 2021 · NVD - Critical 9.8
CVE-2021-21986 · VMware vCenter Server
The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.
Published 26 May 2021 · NVD - Critical 9.8Actively exploited
CVE-2021-21985 · VMware vCenter Server
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Published 26 May 2021 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.