UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,138
Published in 7 days
704
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,138 vulnerabilities
  1. High 8.8

    CVE-2020-24020 · FFmpeg

    Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.c due to a call to memcpy without length checks, which could let a remote malicious user execute arbitrary code.

    Published 26 May 2021 · NVD
  2. Medium 6.5

    CVE-2021-26034 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.

    Published 26 May 2021 · NVD
  3. Medium 6.5

    CVE-2021-26033 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.

    Published 26 May 2021 · NVD
  4. Medium 6.1

    CVE-2021-26032 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.

    Published 26 May 2021 · NVD
  5. Critical 9.8

    CVE-2021-33574 · GNU C Library

    The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

    Published 25 May 2021 · NVD
  6. Medium 6.5

    CVE-2020-20453 · FFmpeg

    FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service

    Published 25 May 2021 · NVD
  7. High 7.5

    CVE-2020-20451 · FFmpeg

    Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.

    Published 25 May 2021 · NVD
  8. High 7.5

    CVE-2020-20450 · FFmpeg

    FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service.

    Published 25 May 2021 · NVD
  9. Medium 6.5

    CVE-2020-20448 · FFmpeg

    FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of Service.

    Published 25 May 2021 · NVD
  10. Medium 6.5

    CVE-2020-20446 · FFmpeg

    FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.

    Published 25 May 2021 · NVD
  11. Medium 6.5

    CVE-2020-20445 · FFmpeg

    FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service.

    Published 25 May 2021 · NVD
  12. High 7.5

    CVE-2020-21041 · FFmpeg

    Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service

    Published 24 May 2021 · NVD
  13. Critical 9.8

    CVE-2020-28910 · Nagios XI

    Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh.

    Published 24 May 2021 · NVD
  14. High 8.8

    CVE-2020-28906 · Nagios XI

    Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.

    Published 24 May 2021 · NVD
  15. Critical 9.8

    CVE-2020-28900 · Nagios XI

    Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.

    Published 24 May 2021 · NVD
  16. High 7.5

    CVE-2021-29258 · Envoy

    An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.

    Published 20 May 2021 · NVD
  17. High 7.5

    CVE-2021-28683 · Envoy

    An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.

    Published 20 May 2021 · NVD
  18. High 7.5

    CVE-2021-28682 · Envoy

    An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.

    Published 20 May 2021 · NVD
  19. Critical 9.8

    CVE-2021-32619 · Deno

    Static imports inside dynamically imported modules do not adhere to permission checks

    Published 20 May 2021 · Fixed in 1.10.2 · NVD, Project advisories (GitHub)
  20. Medium 5.7

    CVE-2021-3426 · Python

    There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions…

    Published 20 May 2021 · Fixed in 3.7.10, 3.8.8, 3.9.3 · NVD
  21. Medium 6.1

    CVE-2021-29625 · Adminer

    Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In…

    Published 19 May 2021 · Fixed in 4.8.1 · NVD
  22. High 8.6

    CVE-2021-3517 · Java, libxml2

    There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an…

    Published 19 May 2021 · Fixed in 2.9.11 · NVD
  23. Medium 6.5

    CVE-2020-20266 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 19 May 2021 · Fixed in 6.47 · NVD
  24. Medium 6.5

    CVE-2020-20264 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.

    Published 19 May 2021 · Fixed in 6.47 · NVD
  25. High 8.5

    CVE-2021-30465 · runc

    mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

    Published 19 May 2021 · Fixed in 1.0.0-rc95 · NVD, Project advisories (GitHub)
  26. Medium 6.5

    CVE-2020-20246 · MikroTik RouterOS

    Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.

    Published 18 May 2021 · NVD
  27. Medium 6.5

    CVE-2020-20245 · MikroTik RouterOS

    Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the log process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.

    Published 18 May 2021 · NVD
  28. Medium 6.5

    CVE-2020-20227 · MikroTik RouterOS

    Mikrotik RouterOs stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.

    Published 18 May 2021 · NVD
  29. Medium 6.5

    CVE-2020-20220 · MikroTik RouterOS

    Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 18 May 2021 · Fixed in 6.47 · NVD
  30. Medium 6.5

    CVE-2020-20237 · MikroTik RouterOS

    Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.

    Published 18 May 2021 · NVD
  31. Medium 6.5

    CVE-2020-20236 · MikroTik RouterOS

    Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.

    Published 18 May 2021 · NVD
  32. Medium 6.5

    CVE-2020-20222 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 18 May 2021 · NVD
  33. Medium 6.5

    CVE-2020-20214 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.6 (long-term tree) suffers from an assertion failure vulnerability in the btest process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.

    Published 18 May 2021 · NVD
  34. Medium 6.5

    CVE-2020-20254 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 18 May 2021 · Fixed in 6.47 · NVD
  35. Medium 6.5

    CVE-2020-20253 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.

    Published 18 May 2021 · Fixed in 6.47 · NVD
  36. High 7.8

    CVE-2021-22117 · RabbitMQ

    RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.

    Published 18 May 2021 · Fixed in 3.8.16 · NVD
  37. High 8.8

    CVE-2021-3518 · libxml2

    There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

    Published 18 May 2021 · Fixed in 2.9.11 · NVD
  38. High 8.8

    CVE-2021-31827 · MOVEit Transfer

    In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of…

    Published 18 May 2021 · Fixed in 2021.0 · NVD
  39. Medium 5.3

    CVE-2020-13667 · Drupal

    Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the…

    Published 17 May 2021 · Fixed in 8.8.10, 8.9.6, 9.0.6 · NVD
  40. Medium 6.1

    CVE-2019-14827 · Moodle

    A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5,…

    Published 17 May 2021 · NVD
  41. Medium 4.3

    CVE-2021-29052 · Liferay Portal / DXP

    The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.

    Published 17 May 2021 · NVD
  42. Medium 6.1

    CVE-2021-29051 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter.

    Published 17 May 2021 · NVD
  43. Medium 6.1

    CVE-2021-29048 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.

    Published 17 May 2021 · NVD
  44. High 8.8

    CVE-2021-29053 · Liferay Portal / DXP

    Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.

    Published 17 May 2021 · NVD
  45. Medium 6.1

    CVE-2021-29046 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.

    Published 17 May 2021 · NVD
  46. Medium 6.1

    CVE-2021-29045 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter.

    Published 17 May 2021 · NVD
  47. Medium 6.1

    CVE-2021-29044 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.

    Published 17 May 2021 · NVD
  48. Medium 5.9

    CVE-2021-29043 · Liferay Portal / DXP

    The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.

    Published 17 May 2021 · NVD
  49. High 7.5

    CVE-2021-29047 · Liferay Portal / DXP

    The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.

    Published 16 May 2021 · NVD
  50. Medium 5.3

    CVE-2021-29040 · Liferay Portal / DXP

    The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.

    Published 16 May 2021 · Fixed in 7.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.