UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,141
Published in 7 days
695
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,141 vulnerabilities
  1. Medium

    GHSA-3pcr-4982-548m · Shopware

    Exposure of .env if project root is configured as web root

    Published 12 Apr 2021 · Fixed in 6.3.5.3 · Project advisories (GitHub)
  2. Critical

    GHSA-qg7c-q3vq-rgxr · Shopware

    Leak of information via Store-API aggregations

    Published 12 Apr 2021 · Fixed in 6.3.5.3 · Project advisories (GitHub)
  3. Medium 5.4

    CVE-2021-24329 · WP Super Cache (WordPress plugin)

    WP Super Cache: Cross-site Scripting

    Published 12 Apr 2021 · Fixed in 1.7.3 · WPVulnerability
  4. Critical 9.8

    CVE-2021-28879 · Rust

    In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.

    Published 11 Apr 2021 · Fixed in 1.52.0 · NVD
  5. High 7.5

    CVE-2021-28878 · Rust

    In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    Published 11 Apr 2021 · Fixed in 1.52.0 · NVD
  6. High 7.5

    CVE-2021-28877 · Rust

    In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    Published 11 Apr 2021 · Fixed in 1.51.0 · NVD
  7. Medium 5.3

    CVE-2021-28876 · Rust

    In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

    Published 11 Apr 2021 · Fixed in 1.52.0 · NVD
  8. High 7.5

    CVE-2021-28875 · Rust

    In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.

    Published 11 Apr 2021 · Fixed in 1.50.0 · NVD
  9. Critical 9.8

    CVE-2020-36318 · Rust

    In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.

    Published 11 Apr 2021 · Fixed in 1.49.0 · NVD
  10. High 7.5

    CVE-2020-36317 · Rust

    In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.

    Published 11 Apr 2021 · Fixed in 1.49.0 · NVD
  11. High 7.5

    CVE-2015-20001 · Rust

    In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation.

    Published 11 Apr 2021 · Fixed in 1.2.0 · NVD
  12. High 7.0

    CVE-2021-29221 · Erlang/OTP

    A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe…

    Published 9 Apr 2021 · Fixed in 23.2.3 · NVD
  13. Medium 4.3

    CVE-2021-30159 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if…

    Published 9 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  14. Medium 4.3

    CVE-2021-30156 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists.

    Published 9 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  15. Medium 4.3

    CVE-2021-30155 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.

    Published 9 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  16. Medium 4.3

    CVE-2021-30152 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.

    Published 9 Apr 2021 · Fixed in 1.31.13, 1.35.2 · NVD
  17. Medium 5.3

    CVE-2020-36287 · Jira

    The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check.

    Published 9 Apr 2021 · Fixed in 8.13.5, 8.15.1 · NVD
  18. Medium 6.5

    CVE-2021-20480 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502.

    Published 8 Apr 2021 · NVD
  19. High 7.5

    CVE-2021-1405 · ClamAV

    A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted…

    Published 8 Apr 2021 · NVD
  20. High 7.5

    CVE-2021-1404 · ClamAV

    A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to…

    Published 8 Apr 2021 · NVD
  21. High 7.5

    CVE-2021-1252 · ClamAV

    A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper error handling that may result in an infinite loop. An attacker could exploit this vulnerability by sending a crafted Excel file to…

    Published 8 Apr 2021 · NVD
  22. High 8.8

    CVE-2021-26758 · OpenLiteSpeed

    Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.

    Published 7 Apr 2021 · NVD
  23. High 8.8

    CVE-2021-30123 · FFmpeg

    FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution.

    Published 7 Apr 2021 · NVD
  24. Medium 4.3

    CVE-2021-21640 · Jenkins

    Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

    Published 7 Apr 2021 · NVD
  25. Medium 4.3

    CVE-2021-21639 · Jenkins

    Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

    Published 7 Apr 2021 · NVD
  26. Critical 9.8

    CVE-2021-30164 · Redmine

    Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.

    Published 6 Apr 2021 · Fixed in 4.0.8, 4.1.2 · NVD
  27. High 7.5

    CVE-2021-30163 · Redmine

    Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values.

    Published 6 Apr 2021 · Fixed in 4.0.8, 4.1.2 · NVD
  28. Medium 5.3

    CVE-2020-36308 · Redmine

    Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.

    Published 6 Apr 2021 · Fixed in 4.0.7, 4.1.1 · NVD
  29. Medium 6.1

    CVE-2020-36307 · Redmine

    Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.

    Published 6 Apr 2021 · Fixed in 4.0.7, 4.1.1 · NVD
  30. Medium 6.1

    CVE-2020-36306 · Redmine

    Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.

    Published 6 Apr 2021 · Fixed in 4.0.7, 4.1.1 · NVD
  31. Medium 5.3

    CVE-2019-25026 · Redmine

    Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.

    Published 6 Apr 2021 · Fixed in 3.4.13, 4.0.6 · NVD
  32. Medium 5.3

    CVE-2021-30158 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party.

    Published 6 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  33. Medium 6.1

    CVE-2021-30157 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.

    Published 6 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  34. Medium 6.1

    CVE-2021-30154 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.

    Published 6 Apr 2021 · Fixed in 1.31.12, 1.35.2 · NVD
  35. High 8.8

    CVE-2021-24159 · Contact Form 7

    Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully…

    Published 5 Apr 2021 · NVD
  36. Critical 9.8

    CVE-2021-22203 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5 · NVD
  37. Medium 4.3

    CVE-2021-22202 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.

    Published 2 Apr 2021 · NVD
  38. Medium 6.5

    CVE-2021-22201 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.

    Published 2 Apr 2021 · Fixed in 13.9.5, 13.10.1 · NVD
  39. High 7.5

    CVE-2021-22200 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5 · NVD
  40. Medium 4.3

    CVE-2021-22198 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  41. Medium 4.3

    CVE-2021-22197 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  42. Medium 5.4

    CVE-2021-22196 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  43. Medium 4.3

    CVE-2021-26072 · Confluence

    The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

    Published 1 Apr 2021 · Fixed in 5.8.6 · NVD
  44. Low 3.7

    CVE-2021-22890 · curl

    curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a…

    Published 1 Apr 2021 · NVD
  45. Medium 5.3

    CVE-2021-22876 · curl

    curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the…

    Published 1 Apr 2021 · NVD
  46. High 7.5

    CVE-2021-28165 · Eclipse Jetty, Jenkins

    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

    Published 1 Apr 2021 · Fixed in 9.4.39, 10.0.2, 11.0.2 · NVD
  47. Medium 5.3

    CVE-2021-28164 · Eclipse Jetty

    In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

    Published 1 Apr 2021 · NVD
  48. Low 2.7

    CVE-2021-28163 · Apache Solr, Eclipse Jetty

    In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

    Published 1 Apr 2021 · Fixed in 9.4.39 · NVD
  49. Medium 4.3

    CVE-2021-22177 · GitLab

    Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.

    Published 1 Apr 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  50. Medium 4.3

    CVE-2021-3393 · PostgreSQL

    An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but…

    Published 1 Apr 2021 · Fixed in 11.11, 12.6, 13.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.