UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,141
Published in 7 days
695
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,141 vulnerabilities
  1. High 7.5

    CVE-2021-21348 · Apache ActiveMQ, MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  2. Critical 9.8

    CVE-2021-21347 · Apache ActiveMQ, Oracle WebLogic Server

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  3. Critical 9.8

    CVE-2021-21346 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  4. Critical 9.9

    CVE-2021-21345 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  5. Critical 9.8

    CVE-2021-21344 · Apache ActiveMQ, MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  6. High 7.5

    CVE-2021-21343 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  7. Critical 9.1

    CVE-2021-21342 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  8. High 7.5

    CVE-2021-21341 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  9. Medium 6.1

    CVE-2021-24891 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 23 Mar 2021 · Fixed in 3.1.4, 3.4.8, 3.6.3 · NVD, WPVulnerability
  10. Medium 4.4

    CVE-2021-27908 · Mautic

    Secret data exfiltration via symfony parameters

    Published 22 Mar 2021 · Fixed in 3.3.2 · NVD, Project advisories (GitHub)
  11. High 7.5

    CVE-2021-28148 · Grafana

    One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

    Published 22 Mar 2021 · Fixed in 6.7.6, 7.3.10, 7.4.5 · NVD
  12. Medium 6.5

    CVE-2021-28147 · Grafana

    The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions…

    Published 22 Mar 2021 · Fixed in 6.7.6, 7.3.10, 7.4.5 · NVD
  13. Medium 6.5

    CVE-2021-28146 · Grafana

    The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.

    Published 22 Mar 2021 · Fixed in 7.4.5 · NVD
  14. High 7.1

    CVE-2021-27962 · Grafana

    Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.

    Published 22 Mar 2021 · Fixed in 7.3.10, 7.4.5 · NVD
  15. Critical 9.8

    CVE-2021-26295 · Apache OFBiz

    Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

    Published 22 Mar 2021 · Fixed in 17.12.06 · NVD
  16. High 7.2

    CVE-2021-26070 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

    Published 22 Mar 2021 · Fixed in 8.13.3, 8.14.1 · NVD
  17. Medium 5.3

    CVE-2021-26069 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/{id}/ActionsAndOperations API endpoint. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.

    Published 22 Mar 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD
  18. Medium 6.1

    CVE-2019-14831 · Moodle

    A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.

    Published 19 Mar 2021 · NVD
  19. Medium 6.1

    CVE-2019-14830 · Moodle

    A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is…

    Published 19 Mar 2021 · NVD
  20. Medium 4.3

    CVE-2019-14829 · Moodle

    A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.

    Published 19 Mar 2021 · NVD
  21. Medium 4.3

    CVE-2019-14828 · Moodle

    A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.

    Published 19 Mar 2021 · NVD
  22. High 7.8

    CVE-2019-10128 · PostgreSQL

    A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read…

    Published 19 Mar 2021 · Fixed in 9.6.13, 10.8, 11.3 · NVD
  23. High 8.8

    CVE-2019-10127 · PostgreSQL

    A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL…

    Published 19 Mar 2021 · Fixed in 9.6.13, 10.8, 11.3 · NVD
  24. Medium 5.9

    CVE-2021-21390 · MinIO

    MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies…

    Published 19 Mar 2021 · Fixed in 2021-03-17t02-33-02z · NVD
  25. Medium 5.5

    CVE-2021-27506 · ClamAV

    The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.

    Published 19 Mar 2021 · NVD
  26. High 7.2

    CVE-2021-27928 · MariaDB

    A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this…

    Published 19 Mar 2021 · Fixed in 10.3.28, 10.4.18, 10.5.9 · NVD
  27. High 8.1

    CVE-2021-27221 · MikroTik RouterOS

    MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work

    Published 19 Mar 2021 · NVD
  28. High 7.5

    CVE-2021-27358 · Grafana

    The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

    Published 18 Mar 2021 · NVD
  29. Medium 5.4

    CVE-2021-28145 · Concrete CMS

    Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

    Published 18 Mar 2021 · Fixed in 8.5.5 · NVD
  30. Unrated

    WPV-c9c9e938ba16 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 17 Mar 2021 · Fixed in 3.1.4 · WPVulnerability
  31. Medium 5.4

    CVE-2021-24206 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  32. Medium 5.4

    CVE-2021-24205 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  33. Medium 5.4

    CVE-2021-24204 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  34. Medium 5.4

    CVE-2021-24203 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  35. Medium 5.4

    CVE-2021-24202 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  36. Medium 5.4

    CVE-2021-24201 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  37. Critical 9.8

    CVE-2020-24264 · Portainer

    Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine…

    Published 16 Mar 2021 · NVD
  38. High 8.8

    CVE-2020-24263 · Portainer

    Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host.

    Published 16 Mar 2021 · NVD
  39. Medium 5.4

    CVE-2021-21370 · TYPO3

    Cross-Site Scripting in Content Preview (CType menu)

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  40. Medium 5.4

    CVE-2021-21358 · TYPO3

    Cross-Site Scripting in Form Framework

    Published 16 Mar 2021 · Fixed in 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  41. High 8.3

    CVE-2021-21357 · TYPO3

    Broken Access Control in Form Framework

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  42. High 8.6

    CVE-2021-21355 · TYPO3

    Unrestricted File Upload in Form Framework

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  43. Medium 5.4

    CVE-2021-21340 · TYPO3

    Cross-Site Scripting in Content Preview (descriptionColumn)

    Published 16 Mar 2021 · Fixed in 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  44. High 7.5

    CVE-2021-21339 · TYPO3

    Cleartext storage of session identifier

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  45. Medium 6.1

    CVE-2021-21338 · TYPO3

    Open Redirection in Login Handling

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  46. High 7.5

    CVE-2021-21359 · TYPO3

    Denial of Service in Page Error Handling

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  47. High 7.2

    CVE-2021-24209 · WP Super Cache (WordPress plugin)

    WP Super Cache: Code Injection

    Published 16 Mar 2021 · Fixed in 1.7.2 · WPVulnerability
  48. Medium 4.3

    CVE-2021-20283 · Moodle

    The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD
  49. Medium 5.3

    CVE-2021-20282 · Moodle

    When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD
  50. Medium 5.3

    CVE-2021-20281 · Moodle

    It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.