UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,141
Published in 7 days
700
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,141 vulnerabilities
  1. Critical 9.8

    CVE-2021-2136 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle…

    Published 22 Apr 2021 · NVD
  2. Critical 9.8

    CVE-2021-2135 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of…

    Published 22 Apr 2021 · NVD
  3. Medium 5.4

    CVE-2021-22199 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used.

    Published 22 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  4. High 7.5

    CVE-2021-29653 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.

    Published 22 Apr 2021 · Fixed in 1.5.8, 1.6.4, 1.7.1 · NVD
  5. High 7.5

    CVE-2021-27400 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1

    Published 22 Apr 2021 · Fixed in 1.6.4, 1.7.1 · NVD
  6. High 7.5

    CVE-2021-31555 · MediaWiki

    An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version) parameter's length.

    Published 22 Apr 2021 · NVD
  7. Medium 5.4

    CVE-2021-31554 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created MediaWiki user accounts, thus allowing nefarious users to remain unblocked.

    Published 22 Apr 2021 · NVD
  8. Medium 6.5

    CVE-2021-31553 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such that denial of service occurred for certain CheckUser extension pages and functionality. For example, the attacker could turn off Special:CheckUserLog and thus interfere with usage tracking.

    Published 22 Apr 2021 · NVD
  9. Medium 5.4

    CVE-2021-31552 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account (and not the user account itself). Such rules could also be used by a nefarious, unprivileged user to…

    Published 22 Apr 2021 · NVD
  10. Medium 6.1

    CVE-2021-31551 · MediaWiki

    An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.

    Published 22 Apr 2021 · NVD
  11. Medium 5.4

    CVE-2021-31550 · MediaWiki

    An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.

    Published 22 Apr 2021 · NVD
  12. Medium 4.3

    CVE-2021-31549 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users.

    Published 22 Apr 2021 · NVD
  13. Medium 6.5

    CVE-2021-31548 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.

    Published 22 Apr 2021 · NVD
  14. Medium 4.3

    CVE-2021-31547 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.

    Published 22 Apr 2021 · NVD
  15. Medium 4.3

    CVE-2021-31546 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have been visible to users with access to view AbuseFilter log data.

    Published 22 Apr 2021 · NVD
  16. Medium 5.3

    CVE-2021-31545 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWiki usernames, related to rev_deleted.

    Published 22 Apr 2021 · NVD
  17. High 8.2

    CVE-2021-20454 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.

    Published 21 Apr 2021 · NVD
  18. High 7.5

    CVE-2021-28965 · Ruby

    The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

    Published 21 Apr 2021 · Fixed in 2.6.7, 2.7.3, 3.0.1 · NVD
  19. Medium 4.8

    CVE-2021-24323 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 21 Apr 2021 · Fixed in 5.2.0 · NVD, WPVulnerability
  20. High 8.2

    CVE-2021-20453 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648.

    Published 20 Apr 2021 · Fixed in 8.0.0.15, 8.5.5.20, 9.0.5.8 · NVD
  21. Low 2.3

    CVE-2021-3037 · Palo Alto Networks PAN-OS

    An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server.

    Published 20 Apr 2021 · Fixed in 8.1.19, 9.0.13, 9.1.4 · NVD
  22. Medium 4.4

    CVE-2021-3036 · Palo Alto Networks PAN-OS

    An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client includes a duplicate API parameter in API…

    Published 20 Apr 2021 · Fixed in 9.0.12, 9.1.6, 10.0.1 · NVD
  23. Medium 4.8

    CVE-2021-29434 · Wagtail

    Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

    Published 19 Apr 2021 · Fixed in 2.11.6, 2.11.7, 2.12.4 · NVD, Project advisories (GitHub)
  24. Medium 5.4

    CVE-2021-21087 · Adobe ColdFusion

    Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.

    Published 15 Apr 2021 · NVD
  25. Medium 6.5

    CVE-2021-29447 · WordPress

    WordPress: Authenticated XXE attack when installation is running PHP 8

    Published 15 Apr 2021 · Fixed in 5.7.1 · NVD, WordPress
  26. Medium 4.3

    CVE-2021-29450 · WordPress

    WordPress: Authenticated disclosure of password-protected posts and pages

    Published 15 Apr 2021 · Fixed in 5.7.1 · NVD, WordPress
  27. Low 3.7

    CVE-2021-26076 · Jira

    The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was…

    Published 15 Apr 2021 · Fixed in 8.5.12, 8.13.4, 8.15.1 · NVD
  28. Medium 4.3

    CVE-2021-26075 · Jira

    The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before 8.15.1 allowed remote authenticated attackers to obtain the full path of the Jira application data directory via an information disclosure vulnerability in the error message when presented with an invalid filename.

    Published 15 Apr 2021 · Fixed in 8.5.12, 8.13.4, 8.15.1 · NVD
  29. Medium 6.1

    CVE-2020-36288 · Jira

    The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution.

    Published 15 Apr 2021 · Fixed in 8.5.12, 8.13.4, 8.15.1 · NVD
  30. Medium 5.3

    CVE-2021-26031 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.

    Published 14 Apr 2021 · NVD
  31. Medium 6.1

    CVE-2021-26030 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page

    Published 14 Apr 2021 · NVD
  32. Critical 9.8

    CVE-2021-31162 · Rust

    In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.

    Published 14 Apr 2021 · Fixed in 1.52.0 · NVD
  33. High 8.2

    CVE-2020-36323 · Rust

    In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

    Published 14 Apr 2021 · Fixed in 1.52.0 · NVD
  34. Medium 5.9

    CVE-2018-25008 · Rust

    In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions.

    Published 14 Apr 2021 · Fixed in 1.29.0 · NVD
  35. Medium 5.9

    CVE-2017-20004 · Rust

    In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any types, allowing for memory safety issues through race conditions.

    Published 14 Apr 2021 · Fixed in 1.19.0 · NVD
  36. High 7.2

    CVE-2021-29440 · Grav

    Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.

    Published 13 Apr 2021 · Fixed in 1.7.11 · NVD
  37. Critical 9.0

    CVE-2021-28483 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 13 Apr 2021 · NVD
  38. High 8.8

    CVE-2021-28482 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 13 Apr 2021 · NVD
  39. Critical 9.8

    CVE-2021-28481 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 13 Apr 2021 · NVD
  40. Critical 9.8

    CVE-2021-28480 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 13 Apr 2021 · NVD
  41. Critical 9.1

    CVE-2021-29943 · Apache Solr

    When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

    Published 13 Apr 2021 · Fixed in 8.8.2 · NVD
  42. Medium 4.8

    CVE-2021-29425 · Oracle WebLogic Server

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

    Published 13 Apr 2021 · NVD
  43. High 7.5

    CVE-2021-29262 · Apache Solr

    When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will…

    Published 13 Apr 2021 · Fixed in 8.8.2 · NVD
  44. Critical 9.8

    CVE-2021-27905 · Apache Solr

    The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards"…

    Published 13 Apr 2021 · Fixed in 8.8.2 · NVD
  45. Unrated

    WPV-f45c2bbf84cc · Woolentor Addons (WordPress plugin)

    Vulnerability in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

    Published 13 Apr 2021 · Fixed in 1.8.6 · WPVulnerability
  46. Medium 5.4

    CVE-2021-24262 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 13 Apr 2021 · Fixed in 1.8.6 · WPVulnerability
  47. Medium 6.5

    CVE-2021-22190 · GitLab

    A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token

    Published 12 Apr 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  48. Medium 6.5

    CVE-2020-15942 · Fortinet FortiWeb

    An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.

    Published 12 Apr 2021 · NVD
  49. Medium 6.5

    CVE-2019-17656 · Fortinet FortiProxy, Fortinet FortiOS

    A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution.

    Published 12 Apr 2021 · Fixed in 1.2.10, 2.0.2 · NVD
  50. Critical

    GHSA-88rc-3p98-rgvx · Shopware

    After order payment process manipulation

    Published 12 Apr 2021 · Fixed in 6.3.5.3 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.