UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,141
Published in 7 days
695
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,141 vulnerabilities
  1. Low 3.5

    CVE-2021-26071 · Jira

    The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.

    Published 1 Apr 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  2. Medium 5.3

    CVE-2020-36286 · Jira

    The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.

    Published 1 Apr 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  3. Medium 5.3

    CVE-2020-36238 · Jira

    The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check.

    Published 1 Apr 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  4. Medium 5.3

    CVE-2021-23007 · F5 BIG-IP

    On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · NVD
  5. High 7.5

    CVE-2021-23004 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  6. High 7.5

    CVE-2021-23003 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the Traffic Management Microkernel (TMM) process may produce a core file when undisclosed MPTCP traffic passes through a standard virtual server. Note: Software versions which have reached End of Software Development (EoSD) are not…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  7. Medium 4.5

    CVE-2021-23002 · F5 BIG-IP

    When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  8. Medium 4.3

    CVE-2021-23001 · F5 BIG-IP

    On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint. Note: Software versions which have reached End of…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  9. High 7.5

    CVE-2021-23000 · F5 BIG-IP

    On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD)…

    Published 31 Mar 2021 · Fixed in 13.1.3.6 · NVD
  10. High 7.5

    CVE-2021-22999 · F5 BIG-IP

    On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.0 · NVD
  11. Medium 5.3

    CVE-2021-22998 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  12. Medium 6.1

    CVE-2021-22994 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  13. Critical 9.8Actively exploited

    CVE-2021-22991 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  14. Critical 9.8

    CVE-2021-22992 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  15. High 7.2

    CVE-2021-22990 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages.…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  16. Critical 9.1

    CVE-2021-22989 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  17. Critical 9.9

    CVE-2021-22987 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  18. High 8.8

    CVE-2021-22988 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  19. Critical 9.8Actively exploited

    CVE-2021-22986 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  20. High 7.8

    CVE-2020-24995 · FFmpeg

    Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local).

    Published 30 Mar 2021 · NVD
  21. Medium 5.4

    CVE-2021-21398 · PrestaShop

    Possible XSS injection through DataColumn Grid class

    Published 30 Mar 2021 · Fixed in 1.7.7.3 · NVD, Project advisories (GitHub)
  22. Medium 6.1

    CVE-2021-29274 · Redmine

    Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.

    Published 29 Mar 2021 · Fixed in 4.1.2 · NVD
  23. Medium

    GHSA-m8w4-6wxv-8v6m · Metabase

    Possible information leakage for Sandboxed users seeing filter list data they may not have access to

    Published 27 Mar 2021 · Project advisories (GitHub)
  24. Medium

    GHSA-pxfh-93j9-h745 · Metabase

    Revision API allows revert of dashboards and viewing history of questions/dashboards without permissions

    Published 27 Mar 2021 · Fixed in 0.37.11 · Project advisories (GitHub)
  25. Medium 4.4

    CVE-2021-22194 · GitLab

    In all versions of GitLab, marshalled session keys were being stored in Redis.

    Published 26 Mar 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  26. Medium 5.5

    CVE-2021-22184 · GitLab

    An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted.

    Published 26 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  27. Medium 4.3

    CVE-2021-22180 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.

    Published 26 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  28. Medium 4.3

    CVE-2021-22172 · GitLab

    Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page

    Published 26 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  29. Medium 6.1

    CVE-2021-22886 · Rocket.Chat

    Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

    Published 26 Mar 2021 · Fixed in 3.8.8, 3.9.7, 3.10.5 · NVD
  30. Medium 5.5

    CVE-2020-27829 · ImageMagick

    A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45.

    Published 26 Mar 2021 · Fixed in 7.0.10-45 · NVD
  31. Medium 5.4

    CVE-2020-19626 · Craft CMS

    Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.

    Published 26 Mar 2021 · NVD
  32. High 7.4

    CVE-2021-3450 · Node.js, OpenSSL, MySQL and 2 more

    The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a…

    Published 25 Mar 2021 · Fixed in 12.22.1, 14.16.1, 15.14.0 · NVD
  33. Medium 5.9

    CVE-2021-3449 · Node.js, OpenSSL, MySQL and 1 more

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server…

    Published 25 Mar 2021 · Fixed in 12.22.1, 14.16.1, 15.14.0 · NVD
  34. Unrated

    WPV-f217dbc5cf8c · Official Facebook Pixel (WordPress plugin)

    Vulnerability in Meta pixel for WordPress

    Published 25 Mar 2021 · Fixed in 3.0.0 · WPVulnerability
  35. Unrated

    WPV-3643b9d5bbd1 · Official Facebook Pixel (WordPress plugin)

    Vulnerability in Meta pixel for WordPress

    Published 25 Mar 2021 · WPVulnerability
  36. High 7.1

    CVE-2026-66705 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Cross-site Scripting

    Published 25 Mar 2021 · Fixed in 5.2.2 · WPVulnerability
  37. High 8.8

    CVE-2021-24218 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Cross-Site Request Forgery (CSRF)

    Published 25 Mar 2021 · WPVulnerability
  38. High 8.1

    CVE-2021-24217 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Deserialization of Untrusted Data

    Published 25 Mar 2021 · Fixed in 3.0.0 · WPVulnerability
  39. Medium 4.3

    CVE-2021-22169 · GitLab

    An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.

    Published 24 Mar 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  40. Low 3.5

    CVE-2021-22193 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.

    Published 24 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  41. High 8.8

    CVE-2021-22192 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.

    Published 24 Mar 2021 · Fixed in 13.7.9, 13.8.6, 13.9.4 · NVD
  42. Medium 4.9

    CVE-2021-22186 · GitLab

    An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners

    Published 24 Mar 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  43. Medium 5.4

    CVE-2021-22185 · GitLab

    Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki

    Published 24 Mar 2021 · Fixed in 13.8.5, 13.9.2 · NVD
  44. Medium 5.4

    CVE-2021-22179 · GitLab

    A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.

    Published 24 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  45. Medium 5.0

    CVE-2021-22178 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.

    Published 24 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  46. Medium 4.3

    CVE-2021-22176 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

    Published 24 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  47. Medium 5.5

    CVE-2021-20227 · SQLite

    A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

    Published 23 Mar 2021 · Fixed in 3.34.1 · NVD
  48. Critical 9.1

    CVE-2021-21351 · Apache ActiveMQ, MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  49. Critical 9.8

    CVE-2021-21350 · Apache ActiveMQ, Oracle WebLogic Server

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  50. High 8.6

    CVE-2021-21349 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.