UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,140
Published in 7 days
703
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,140 vulnerabilities
  1. Critical 9.8

    CVE-2021-23008 · F5 BIG-IP

    On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection or from an AD server compromised by an attacker.…

    Published 10 May 2021 · Fixed in 14.1.3, 15.1.2, 16.0.1 · NVD
  2. Medium 6.5

    CVE-2021-33620 · Squid

    SQUID-2021:5 Denial of Service in HTTP Response processing

    Published 10 May 2021 · Fixed in 4.15, 5.0.6 · NVD, Project advisories (GitHub)
  3. Medium 6.5

    GHSA-pxwq-f3qr-w2xf · Squid

    SQUID-2021:4 Multiple Issues in HTTP Range header

    Published 10 May 2021 · Project advisories (GitHub)
  4. Medium 4.9

    CVE-2021-28652 · Squid

    SQUID-2021:3 Denial of Service issue in Cache Manager

    Published 10 May 2021 · Fixed in 4.15, 5.0.6 · NVD, Project advisories (GitHub)
  5. Medium 6.5

    CVE-2021-28662 · Squid

    SQUID-2021:2 Denial of Service in HTTP Response Processing

    Published 10 May 2021 · Fixed in 4.15, 5.0.6 · NVD, Project advisories (GitHub)
  6. High 7.5

    CVE-2021-28651 · Squid

    SQUID-2021:1 Denial of Service in URN processing

    Published 10 May 2021 · Fixed in 4.15, 5.0.6 · NVD, Project advisories (GitHub)
  7. Medium 4.8

    CVE-2021-24423 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 9 May 2021 · Fixed in 1.6.59, 1.16.59 · NVD, WPVulnerability
  8. High 8.8

    CVE-2021-24307 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Deserialization of Untrusted Data

    Published 9 May 2021 · Fixed in 4.1.0.2 · WPVulnerability
  9. Medium 6.1

    CVE-2021-32470 · Craft CMS

    Craft CMS before 3.6.13 has an XSS vulnerability.

    Published 7 May 2021 · Fixed in 3.6.13 · NVD
  10. Medium 4.3

    CVE-2020-29445 · Confluence

    Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters.

    Published 7 May 2021 · Fixed in 7.4.8, 7.11.0 · NVD
  11. Medium 5.4

    CVE-2020-29444 · Confluence

    Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters.

    Published 7 May 2021 · Fixed in 7.11.0 · NVD
  12. Medium 5.3

    CVE-2019-25043 · ModSecurity

    ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header.

    Published 6 May 2021 · Fixed in 3.0.4 · NVD
  13. High 8.1

    CVE-2021-28128 · Strapi

    In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.

    Published 6 May 2021 · NVD
  14. Medium 5.3

    CVE-2021-22210 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results.

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  15. High 7.5

    CVE-2021-22209 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed.

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  16. Medium 4.3

    CVE-2021-22208 · GitLab

    An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update.

    Published 6 May 2021 · Fixed in 13.9.7 · NVD
  17. Medium 4.9

    CVE-2021-22206 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  18. Critical 9.8

    CVE-2021-29921 · Python

    In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

    Published 6 May 2021 · Fixed in 3.8.12, 3.9.5 · NVD
  19. Medium 6.3

    CVE-2021-27216 · Exim

    Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  20. Medium 4.3

    CVE-2021-22211 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling.

    Published 6 May 2021 · Fixed in 13.9.7, 13.10.4, 13.11.2 · NVD
  21. Critical 9.8

    CVE-2020-28026 · Exim

    Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  22. High 7.5

    CVE-2020-28025 · Exim

    Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  23. Critical 9.8

    CVE-2020-28024 · Exim

    Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  24. High 7.5

    CVE-2020-28023 · Exim

    Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  25. Critical 9.8

    CVE-2020-28022 · Exim

    Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  26. High 8.8

    CVE-2020-28021 · Exim

    Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  27. Critical 9.8

    CVE-2020-28020 · Exim

    Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.

    Published 6 May 2021 · Fixed in 4.92 · NVD
  28. High 7.5

    CVE-2020-28019 · Exim

    Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  29. Critical 9.8

    CVE-2020-28018 · Exim

    Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  30. Critical 9.8

    CVE-2020-28017 · Exim

    Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.

    Published 6 May 2021 · Fixed in 4.94.1 · NVD
  31. High 7.8

    CVE-2020-28016 · Exim

    Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  32. High 7.8

    CVE-2020-28015 · Exim

    Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  33. Medium 6.1

    CVE-2020-28014 · Exim

    Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  34. High 7.8

    CVE-2020-28013 · Exim

    Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  35. High 7.8

    CVE-2020-28012 · Exim

    Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  36. High 7.8

    CVE-2020-28011 · Exim

    Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  37. High 7.8

    CVE-2020-28010 · Exim

    Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms).

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  38. High 7.8

    CVE-2020-28009 · Exim

    Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days).

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  39. High 7.8

    CVE-2020-28008 · Exim

    Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  40. High 7.8

    CVE-2020-28007 · Exim

    Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.

    Published 6 May 2021 · Fixed in 4.94.2 · NVD
  41. Medium 4.9

    CVE-2020-23128 · Chamilo LMS

    Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege.

    Published 6 May 2021 · NVD
  42. High 8.8

    CVE-2020-23127 · Chamilo LMS

    Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user.

    Published 6 May 2021 · NVD
  43. Critical 9.8

    CVE-2020-13665 · Drupal

    Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.

    Published 5 May 2021 · Fixed in 8.8.8, 8.9.1, 9.0.1 · NVD
  44. High 8.8

    CVE-2020-13664 · Drupal

    Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected.…

    Published 5 May 2021 · Fixed in 8.8.8, 8.9.1, 9.0.1 · NVD
  45. Medium 6.1

    CVE-2020-13662 · Drupal

    Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.

    Published 5 May 2021 · NVD
  46. Medium 6.8

    CVE-2021-20254 · Samba

    A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the…

    Published 5 May 2021 · Fixed in 4.12.15, 4.13.8, 4.14.4 · NVD
  47. Medium 6.1

    CVE-2020-13666 · Drupal

    Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

    Published 5 May 2021 · Fixed in 8.8.10, 8.9.6, 9.0.6 · NVD
  48. High 7.5

    CVE-2021-3154 · SolarWinds Serv-U

    An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a distinct fix relative to CVE-2020-35481.

    Published 4 May 2021 · Fixed in 15.2.2 · NVD
  49. Medium 6.1

    CVE-2020-23015 · OPNsense

    An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website.

    Published 3 May 2021 · NVD
  50. High 7.5

    CVE-2021-29477 · Redis

    Vulnerability in the STRALGO LCS command

    Published 3 May 2021 · Fixed in 6.0.13 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.