UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,140
Published in 7 days
702
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,140 vulnerabilities
  1. High 7.5

    CVE-2021-29478 · Redis

    Vulnerability in the COPY command for large intsets

    Published 3 May 2021 · Project advisories (GitHub)
  2. Medium 6.5

    CVE-2020-20247 · MikroTik RouterOS

    Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due via the loop counter variable.

    Published 3 May 2021 · Fixed in 6.46.5 · NVD
  3. Medium 6.5

    CVE-2020-20218 · MikroTik RouterOS

    Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due via the loop counter variable.

    Published 3 May 2021 · NVD
  4. Medium 5.2

    CVE-2021-21264 · October CMS

    Bypass of fix for CVE-2020-26231, Twig sandbox escape

    Published 2 May 2021 · NVD, Project advisories (GitHub)
  5. Medium 6.1

    CVE-2021-28359 · Apache Airflow

    The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version…

    Published 2 May 2021 · Fixed in 1.10.15, 2.0.2 · NVD
  6. Medium 6.5

    CVE-2021-20326 · MongoDB

    A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4.

    Published 30 Apr 2021 · Fixed in 4.4.4 · NVD
  7. Medium 6.8

    CVE-2021-29484 · Ghost

    Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. We can find no…

    Published 29 Apr 2021 · Fixed in 4.3.3 · NVD
  8. High 7.5

    CVE-2021-1504 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to lack of proper input validation of the HTTPS request. An attacker could exploit these vulnerabilities by sending a crafted HTTPS…

    Published 29 Apr 2021 · Fixed in 9.13.1.21, 9.14.2.4, 9.15.1.7 · NVD
  9. High 7.5

    CVE-2021-1501 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in a denial of service (DoS) condition.The vulnerability is due to a crash that occurs during a hash lookup for a SIP pinhole connection. An…

    Published 29 Apr 2021 · Fixed in 9.13.1.21, 9.14.2.13, 9.15.1.15 · NVD
  10. High 7.1

    CVE-2021-1493 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An…

    Published 29 Apr 2021 · Fixed in 9.13.1.21, 9.14.2.8, 9.15.1.7 · NVD
  11. Medium 6.7

    CVE-2021-1488 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system (OS). This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by…

    Published 29 Apr 2021 · Fixed in 9.13.1.21, 9.14.2.13, 9.15.1.10 · NVD
  12. Medium 6.7

    CVE-2021-1476 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the CLI of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this…

    Published 29 Apr 2021 · Fixed in 9.13.1.21, 9.14.2.13, 9.15.1.10 · NVD
  13. High 7.5

    CVE-2021-1445 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to lack of proper input validation of the HTTPS request. An attacker could exploit these vulnerabilities by sending a crafted HTTPS…

    Published 29 Apr 2021 · Fixed in 9.13.1.21, 9.14.2.8, 9.15.1.7 · NVD
  14. Critical 9.8

    CVE-2021-25216 · BIND 9

    In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings…

    Published 29 Apr 2021 · Fixed in 9.11.31, 9.16.15, 9.17.12 · NVD
  15. High 7.5

    CVE-2021-25215 · BIND 9

    In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion…

    Published 29 Apr 2021 · Fixed in 9.11.31, 9.16.15, 9.17.12 · NVD
  16. Medium 6.5

    CVE-2021-25214 · BIND 9

    In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed…

    Published 29 Apr 2021 · Fixed in 9.11.31, 9.16.15, 9.17.12 · NVD
  17. Unrated

    WPV-72dac1cfa68d · WooCommerce

    Vulnerability in WooCommerce

    Published 29 Apr 2021 · Fixed in 5.2.0 · WPVulnerability
  18. High

    GHSA-4mg9-vhxq-vm7j · Laravel

    SQL Server LIMIT / OFFSET SQL Injection

    Published 28 Apr 2021 · Fixed in 6.20.26 · Project advisories (GitHub)
  19. Medium 6.1

    CVE-2021-29159 · Sonatype Nexus Repository

    A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application.

    Published 28 Apr 2021 · Fixed in 3.30.1 · NVD
  20. Medium 5.3

    CVE-2021-31866 · Redmine

    Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.

    Published 28 Apr 2021 · Fixed in 4.0.9, 4.1.3 · NVD
  21. Medium 5.3

    CVE-2021-31865 · Redmine

    Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.

    Published 28 Apr 2021 · Fixed in 4.0.9, 4.1.3, 4.2.1 · NVD
  22. Medium 5.3

    CVE-2021-31864 · Redmine

    Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler.

    Published 28 Apr 2021 · Fixed in 4.0.9, 4.1.3, 4.2.1 · NVD
  23. High 7.5

    CVE-2021-31863 · Redmine

    Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.

    Published 28 Apr 2021 · Fixed in 4.0.9, 4.1.3, 4.2.1 · NVD
  24. Medium 6.4

    CVE-2021-31779 · Yoast SEO

    The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.

    Published 28 Apr 2021 · Fixed in 7.2.1 · NVD
  25. Critical 9.8

    CVE-2020-36326 · PHPMailer, WordPress

    PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment…

    Published 28 Apr 2021 · Fixed in 5.5.5, 5.6.4, 5.7.2 · NVD
  26. Critical 9.8

    CVE-2021-30128 · Apache OFBiz

    Apache OFBiz has unsafe deserialization prior to 17.12.07 version

    Published 27 Apr 2021 · Fixed in 17.12.07 · NVD
  27. Critical 9.8

    CVE-2021-29200 · Apache OFBiz

    Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

    Published 27 Apr 2021 · Fixed in 17.12.07 · NVD
  28. Medium 5.4

    CVE-2021-21365 · TYPO3

    Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custom code must manually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3…

    Published 27 Apr 2021 · Fixed in 9.1.3, 10.0.10, 11.0.3 · NVD
  29. Medium 6.1

    CVE-2021-28125 · Apache Superset

    Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

    Published 27 Apr 2021 · NVD
  30. Medium 5.4

    CVE-2021-29460 · Kirby

    Cross-site scripting (XSS) from unvalidated uploaded SVG or XML files

    Published 27 Apr 2021 · Fixed in 3.5.4 · NVD, Project advisories (GitHub)
  31. Critical 9.8

    CVE-2019-25042 · Unbound

    Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  32. High 7.5

    CVE-2019-25041 · Unbound

    Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  33. High 7.5

    CVE-2019-25040 · Unbound

    Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  34. Critical 9.8

    CVE-2019-25039 · Unbound

    Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  35. Critical 9.8

    CVE-2019-25038 · Unbound

    Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  36. High 7.5

    CVE-2019-25037 · Unbound

    Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  37. High 7.5

    CVE-2019-25036 · Unbound

    Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  38. Critical 9.8

    CVE-2019-25035 · Unbound

    Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  39. Critical 9.8

    CVE-2019-25034 · Unbound

    Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  40. Critical 9.8

    CVE-2019-25033 · Unbound

    Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  41. Critical 9.8

    CVE-2019-25032 · Unbound

    Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  42. Medium 5.9

    CVE-2019-25031 · Unbound

    Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound…

    Published 27 Apr 2021 · Fixed in 1.9.5 · NVD
  43. Medium 5.3

    CVE-2021-30635 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).

    Published 27 Apr 2021 · Fixed in 3.30.1 · NVD
  44. High 7.5

    CVE-2020-15078 · OpenVPN

    OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

    Published 26 Apr 2021 · Fixed in 2.4.11, 2.5.2 · NVD
  45. Medium 6.1

    CVE-2021-31803 · cPanel & WHM

    cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).

    Published 26 Apr 2021 · Fixed in 94.0.3 · NVD
  46. High 8.8

    CVE-2021-31762 · Webmin

    Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.

    Published 25 Apr 2021 · NVD
  47. Critical 9.6

    CVE-2021-31761 · Webmin

    Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.

    Published 25 Apr 2021 · NVD
  48. High 8.8

    CVE-2021-31760 · Webmin

    Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature.

    Published 25 Apr 2021 · NVD
  49. Medium 4.8

    CVE-2021-24427 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 25 Apr 2021 · Fixed in 2.1.3 · WPVulnerability
  50. Medium 4.9

    CVE-2021-29158 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.

    Published 23 Apr 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.