UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,140
Published in 7 days
705
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,140 vulnerabilities
  1. High 7.5

    CVE-2021-29047 · Liferay Portal / DXP

    The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.

    Published 16 May 2021 · NVD
  2. Medium 5.3

    CVE-2021-29040 · Liferay Portal / DXP

    The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.

    Published 16 May 2021 · Fixed in 7.0 · NVD
  3. Medium 6.1

    CVE-2021-29039 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.

    Published 16 May 2021 · NVD
  4. High 7.5

    CVE-2021-27737 · Apache Traffic Server

    Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.

    Published 14 May 2021 · NVD
  5. Medium 5.9

    CVE-2021-3537 · Java, libxml2

    A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

    Published 14 May 2021 · Fixed in 2.9.11 · NVD
  6. Low 3.3

    CVE-2020-27769 · ImageMagick

    In ImageMagick versions before 7.0.9-0, there are outside the range of representable values of type 'float' at MagickCore/quantize.c.

    Published 14 May 2021 · Fixed in 7.0.9-0 · NVD
  7. Low

    CVE-2021-21424 · Symfony

    Prevent user enumeration in authentication mechanisms

    Published 14 May 2021 · Fixed in 5.2.8 · Project advisories (GitHub)
  8. High 7.2

    CVE-2021-24312 · WP Super Cache (WordPress plugin)

    WP Super Cache: OS Command Injection

    Published 14 May 2021 · Fixed in 1.7.3 · WPVulnerability
  9. Medium 6.5

    CVE-2021-22139 · Kibana

    Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.

    Published 13 May 2021 · Fixed in 7.12.1 · NVD
  10. Medium 5.3

    CVE-2021-22137 · Elasticsearch

    In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker…

    Published 13 May 2021 · Fixed in 6.8.15, 7.11.2 · NVD
  11. Low 3.5

    CVE-2021-22136 · Kibana

    In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session from timing out.

    Published 13 May 2021 · Fixed in 6.8.15, 7.12.0 · NVD
  12. Medium 5.3

    CVE-2021-22135 · Elasticsearch

    Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to…

    Published 13 May 2021 · Fixed in 6.8.15, 7.11.2 · NVD
  13. Low 3.3

    CVE-2020-14354 · c-ares

    A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

    Published 13 May 2021 · NVD
  14. Medium 5.5

    CVE-2021-23135 · Argo CD

    Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.

    Published 12 May 2021 · Fixed in 1.7.14, 1.8.7 · NVD
  15. High 7.5

    CVE-2020-27840 · Samba

    A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.

    Published 12 May 2021 · Fixed in 4.12.13, 4.13.6, 4.14.1 · NVD
  16. High 7.5

    CVE-2021-20277 · Samba

    A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.

    Published 12 May 2021 · Fixed in 4.12.13, 4.13.6, 4.14.1 · NVD
  17. Medium 5.3

    CVE-2020-36289 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

    Published 12 May 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  18. Medium 5.4

    CVE-2021-32604 · SolarWinds Serv-U

    Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."

    Published 11 May 2021 · Fixed in 15.2.3 · NVD
  19. High 7.5

    CVE-2021-20313 · ImageMagick

    A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality.

    Published 11 May 2021 · Fixed in 7.0.11-0 · NVD
  20. High 7.5

    CVE-2021-20312 · ImageMagick

    A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.

    Published 11 May 2021 · Fixed in 7.0.11-0 · NVD
  21. High 7.5

    CVE-2021-20311 · ImageMagick

    A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.

    Published 11 May 2021 · Fixed in 7.0.11-0 · NVD
  22. High 7.5

    CVE-2021-20310 · ImageMagick

    A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.

    Published 11 May 2021 · Fixed in 7.0.11-0 · NVD
  23. High 7.5

    CVE-2021-20309 · ImageMagick

    A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to system availability.

    Published 11 May 2021 · Fixed in 6.9.12, 7.0.11-0 · NVD
  24. Medium 6.5

    CVE-2021-31209 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 11 May 2021 · NVD
  25. Medium 6.6Actively exploited

    CVE-2021-31207 · Microsoft Exchange Server

    Microsoft Exchange Server Security Feature Bypass Vulnerability

    Published 11 May 2021 · NVD
  26. High 7.3

    CVE-2021-31204 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 11 May 2021 · NVD
  27. High 7.8

    CVE-2021-31198 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 11 May 2021 · NVD
  28. Medium 6.5

    CVE-2021-31195 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 11 May 2021 · NVD
  29. Medium 6.5

    CVE-2020-20267 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/resolver process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.

    Published 11 May 2021 · Fixed in 6.47 · NVD
  30. Medium 6.5

    CVE-2020-20265 · MikroTik RouterOS

    Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless process. An authenticated remote attacker can cause a Denial of Service due via a crafted packet.

    Published 11 May 2021 · Fixed in 6.47 · NVD
  31. Critical 9.8

    CVE-2021-31915 · TeamCity

    In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.

    Published 11 May 2021 · Fixed in 2020.2.4 · NVD
  32. Critical 9.8

    CVE-2021-31914 · TeamCity

    In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.

    Published 11 May 2021 · Fixed in 2020.2.4 · NVD
  33. High 7.5

    CVE-2021-31913 · TeamCity

    In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.

    Published 11 May 2021 · Fixed in 2020.2.3 · NVD
  34. High 8.8

    CVE-2021-31912 · TeamCity

    In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.

    Published 11 May 2021 · Fixed in 2020.2.3 · NVD
  35. Medium 6.1

    CVE-2021-31911 · TeamCity

    In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.

    Published 11 May 2021 · Fixed in 2020.2.3 · NVD
  36. High 7.5

    CVE-2021-31910 · TeamCity

    In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.

    Published 11 May 2021 · Fixed in 2020.2.3 · NVD
  37. Medium 5.4

    CVE-2021-3315 · TeamCity

    In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

    Published 11 May 2021 · Fixed in 2020.2.2 · NVD
  38. Critical 9.8

    CVE-2021-31909 · TeamCity

    In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.

    Published 11 May 2021 · Fixed in 2020.2.3 · NVD
  39. Medium 5.4

    CVE-2021-31908 · TeamCity

    In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.

    Published 11 May 2021 · Fixed in 2020.2.3 · NVD
  40. Medium 5.3

    CVE-2021-31907 · TeamCity

    In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.

    Published 11 May 2021 · Fixed in 2020.2.2 · NVD
  41. Low 2.7

    CVE-2021-31906 · TeamCity

    In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.

    Published 11 May 2021 · Fixed in 2020.2.2 · NVD
  42. Medium 6.1

    CVE-2021-31904 · TeamCity

    In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.

    Published 11 May 2021 · Fixed in 2020.2.2 · NVD
  43. High 7.5

    CVE-2021-26310 · TeamCity

    In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.

    Published 11 May 2021 · Fixed in 2020.2.2.85899 · NVD
  44. Low 3.3

    CVE-2021-26309 · TeamCity

    Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.

    Published 11 May 2021 · Fixed in 2020.2.2.85899 · NVD
  45. Medium 5.3

    CVE-2021-23016 · F5 BIG-IP

    On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests to an APM Virtual Server. Note: Software versions which have reached End of Technical Support (EoTS)…

    Published 10 May 2021 · Fixed in 13.1.4, 14.1.4.1, 15.1.3 · NVD
  46. High 7.2

    CVE-2021-23015 · F5 BIG-IP

    On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 May 2021 · Fixed in 14.1.4, 15.1.3, 16.0.1.1 · NVD
  47. High 8.2

    CVE-2021-23012 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not…

    Published 10 May 2021 · Fixed in 14.1.4, 15.1.3, 16.0.1.1 · NVD
  48. High 7.5

    CVE-2021-23009 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not…

    Published 10 May 2021 · Fixed in 15.1.3, 16.0.1.1 · NVD
  49. High 7.5

    CVE-2021-23013 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile. Note:…

    Published 10 May 2021 · Fixed in 14.1.4, 15.1.3, 16.0.1.1 · NVD
  50. High 7.5

    CVE-2021-23011 · F5 BIG-IP

    On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an excessive amount of resources, eventually leading to a restart and failover event. Note: Software versions which have…

    Published 10 May 2021 · Fixed in 14.1.4, 15.1.3, 16.0.1.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.