UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,135
Published in 7 days
695
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,135 vulnerabilities
  1. Medium 6.1

    CVE-2021-27949 · MyBB

    Custom moderator tools reflected XSS

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  2. High 7.2

    CVE-2021-27948 · MyBB

    Usergroups SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  3. High 7.2

    CVE-2021-27947 · MyBB

    Forum Management SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  4. High 8.8

    CVE-2021-27946 · MyBB

    Poll vote count SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  5. High 8.8

    CVE-2021-27890 · MyBB

    Theme properties SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  6. Medium 6.1

    CVE-2021-27889 · MyBB

    Nested Auto URL persistent XSS

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  7. Medium 6.5

    CVE-2020-5016 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary xml files on the system. This does not occur if Application security is enabled. IBM…

    Published 10 Mar 2021 · NVD
  8. High 7.5

    CVE-2021-21265 · October CMS

    Potential Host Header Poisoning on misconfigured servers

    Published 10 Mar 2021 · Fixed in 1.1.2 · NVD, Project advisories (GitHub)
  9. Medium 5.3

    CVE-2021-28116 · Squid

    SQUID-2020:12 Out-Of-Bounds memory access in WCCPv2

    Published 9 Mar 2021 · NVD, Project advisories (GitHub)
  10. Medium 5.5

    CVE-2021-20246 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 6.9.11-62, 7.0.10-62 · NVD
  11. Medium 5.5

    CVE-2021-20245 · ImageMagick

    A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 6.9.11-62, 7.0.10-62 · NVD
  12. Medium 5.5

    CVE-2021-20244 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 7.0.10-62 · NVD
  13. Medium 5.5

    CVE-2021-20243 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 7.0.10-62 · NVD
  14. Medium 5.5

    CVE-2021-20241 · ImageMagick

    A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 6.9.11-62, 7.0.10-62 · NVD
  15. Medium 4.3

    CVE-2021-22134 · Elasticsearch

    A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of…

    Published 8 Mar 2021 · NVD
  16. Medium 6.5

    CVE-2021-21362 · MinIO

    MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can…

    Published 8 Mar 2021 · Fixed in 2021-03-04t00-53-13z · NVD
  17. High 7.5

    CVE-2021-21327 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”. As an example of direct impact, this…

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  18. Medium 6.5

    CVE-2021-21326 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 it is possible to create tickets for another user with self-service interface without delegatee systems enabled. This is fixed in version 9.5.4.

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  19. Medium 4.8

    CVE-2021-21325 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting attack. To exploit this endpoint attacker need to be authenticated. This is fixed in version 9.5.4.

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  20. Medium 6.5

    CVE-2021-21324 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference (IDOR) on "Solutions". This vulnerability gives an unauthorized user the ability to enumerate GLPI items names (including users logins) using the knowbase search form (requires…

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  21. Medium

    GHSA-pjj4-jjgc-h3r8 · Shopware

    Authenticated remote code execution

    Published 8 Mar 2021 · Fixed in 6.3.5.2 · Project advisories (GitHub)
  22. High 7.5

    CVE-2021-32710 · Shopware

    Potential Session Hijacking

    Published 8 Mar 2021 · Fixed in 6.3.5.2 · NVD, Project advisories (GitHub)
  23. High 7.1

    CVE-2021-28041 · OpenSSH

    ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

    Published 5 Mar 2021 · Fixed in 8.5 · NVD
  24. Medium 5.4

    CVE-2021-27907 · Apache Superset

    Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the…

    Published 5 Mar 2021 · NVD
  25. Medium 6.1

    CVE-2021-25313 · Rancher

    A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.

    Published 5 Mar 2021 · Fixed in 2.5.6 · NVD
  26. Medium 6.3

    CVE-2021-21334 · containerd

    containerd CRI plugin: environment variables can leak between containers

    Published 5 Mar 2021 · Fixed in 1.3.10, 1.4.4 · NVD, Project advisories (GitHub)
  27. Medium 5.3

    CVE-2021-26029 · Joomla!

    An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  28. Medium 5.5

    CVE-2021-26028 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  29. Medium 5.3

    CVE-2021-26027 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  30. High 7.5

    CVE-2021-23132 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  31. High 7.5

    CVE-2021-23131 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  32. Medium 6.1

    CVE-2021-23130 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  33. Medium 6.1

    CVE-2021-23129 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  34. Critical 9.1

    CVE-2021-23128 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  35. Critical 9.1

    CVE-2021-23127 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  36. Medium 5.3

    CVE-2021-23126 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  37. Medium 4.3

    CVE-2021-22128 · Fortinet FortiProxy

    An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.

    Published 4 Mar 2021 · NVD
  38. High 7.5

    CVE-2020-15938 · Fortinet FortiOS

    When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header.

    Published 4 Mar 2021 · NVD
  39. High 7.2

    CVE-2021-22189 · GitLab

    Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.

    Published 4 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  40. Medium 5.4

    CVE-2021-22183 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.

    Published 4 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  41. High 8.6

    CVE-2020-25097 · Squid

    SQUID-2020:11 HTTP Request Smuggling

    Published 4 Mar 2021 · Fixed in 4.14, 5.0.5 · NVD, Project advisories (GitHub)
  42. Medium 4.8

    CVE-2021-21314 · GLPI

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.

    Published 3 Mar 2021 · Fixed in 9.5.4 · NVD
  43. Medium 6.1

    CVE-2021-21313 · GLPI

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which…

    Published 3 Mar 2021 · Fixed in 9.5.4 · NVD
  44. Medium 4.8

    CVE-2021-21312 · GLPI

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: "Web Link" is not properly sanitized and a malicious…

    Published 3 Mar 2021 · Fixed in 9.5.4 · NVD
  45. High 7.5

    CVE-2021-22884 · Node.js

    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the…

    Published 3 Mar 2021 · Fixed in 12.21.0, 14.16.0, 15.10.0 · NVD
  46. High 7.5

    CVE-2021-22883 · Node.js

    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file…

    Published 3 Mar 2021 · Fixed in 12.21.0, 14.16.0, 15.10.0 · NVD
  47. Medium 4.8

    CVE-2021-22878 · Nextcloud

    Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

    Published 3 Mar 2021 · Fixed in 20.0.6 · NVD
  48. Medium 6.5

    CVE-2021-22877 · Nextcloud

    A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet.

    Published 3 Mar 2021 · Fixed in 20.0.6 · NVD
  49. Medium 5.3

    CVE-2021-22188 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs.

    Published 3 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  50. Medium 5.4

    CVE-2021-22182 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.

    Published 3 Mar 2021 · Fixed in 13.7.6, 13.8.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.