UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,135
Published in 7 days
669
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,135 vulnerabilities
  1. Medium 6.7

    CVE-2020-8296 · Nextcloud

    Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.

    Published 3 Mar 2021 · Fixed in 20.0.0 · NVD
  2. High 8.8

    CVE-2021-27927 · Zabbix

    In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL…

    Published 3 Mar 2021 · NVD
  3. Medium 6.1

    CVE-2020-15937 · Fortinet FortiOS

    An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard.

    Published 3 Mar 2021 · Fixed in 6.2.5, 6.4.1 · NVD
  4. Medium 4.8

    CVE-2021-23347 · Argo CD

    The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

    Published 3 Mar 2021 · Fixed in 1.7.13, 1.8.6 · NVD
  5. Critical 9.1

    CVE-2021-27078 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  6. High 7.8Actively exploited

    CVE-2021-27065 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  7. High 7.8Actively exploited

    CVE-2021-26858 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  8. High 7.8Actively exploited

    CVE-2021-26857 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  9. Critical 9.1Actively exploited

    CVE-2021-26855 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  10. Medium 6.6

    CVE-2021-26854 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  11. Critical 9.1

    CVE-2021-26412 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  12. Medium 5.4

    CVE-2021-21258 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.

    Published 2 Mar 2021 · Fixed in 9.5.4 · NVD
  13. Medium 5.7

    CVE-2021-21255 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4.

    Published 2 Mar 2021 · NVD
  14. Medium 4.3

    CVE-2021-22187 · GitLab

    An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.

    Published 2 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  15. Medium 4.9

    CVE-2018-25004 · MongoDB

    A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

    Published 1 Mar 2021 · Fixed in 3.6.11, 4.0.6 · NVD
  16. Medium 6.5

    CVE-2020-7929 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.

    Published 1 Mar 2021 · Fixed in 3.6.21, 4.0.20 · NVD
  17. High 7.0

    CVE-2021-25329 · Apache Tomcat

    The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for…

    Published 1 Mar 2021 · NVD
  18. High 7.5

    CVE-2021-25122 · Apache Tomcat

    When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

    Published 1 Mar 2021 · NVD
  19. Medium 5.5

    CVE-2020-27618 · GNU C Library

    The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

    Published 26 Feb 2021 · NVD
  20. Medium 5.3

    CVE-2020-27223 · Apache Solr, Eclipse Jetty

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

    Published 26 Feb 2021 · Fixed in 9.4.36 · NVD
  21. High 8.1

    CVE-2021-26701 · .NET

    .NET Core Remote Code Execution Vulnerability

    Published 25 Feb 2021 · Fixed in 5.0.4 · NVD
  22. High 8.1

    CVE-2021-24112 · .NET

    .NET Core Remote Code Execution Vulnerability

    Published 25 Feb 2021 · NVD
  23. Medium 6.5

    CVE-2021-24085 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 25 Feb 2021 · NVD
  24. Medium 5.4

    CVE-2021-1730 · Microsoft Exchange Server

    <p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update addresses this vulnerability.</p> <p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to…

    Published 25 Feb 2021 · NVD
  25. Medium 6.5

    CVE-2021-1721 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 25 Feb 2021 · NVD
  26. High 7.2

    CVE-2021-3273 · Nagios XI

    Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.

    Published 25 Feb 2021 · Fixed in 5.7 · NVD
  27. High 8.2

    CVE-2020-11987 · Oracle WebLogic Server

    Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

    Published 24 Feb 2021 · NVD
  28. High 8.8

    CVE-2021-21974 · VMware ESXi

    OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.

    Published 24 Feb 2021 · NVD
  29. Medium 5.3Actively exploited

    CVE-2021-21973 · VMware vCenter Server

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5…

    Published 24 Feb 2021 · NVD
  30. Critical 9.8Actively exploited

    CVE-2021-21972 · VMware vCenter Server

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware…

    Published 24 Feb 2021 · NVD
  31. Low 2.5

    CVE-2021-27645 · GNU C Library

    The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

    Published 24 Feb 2021 · NVD
  32. Medium 4.3

    CVE-2021-20229 · PostgreSQL

    A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

    Published 23 Feb 2021 · Fixed in 13.2 · NVD
  33. Low 3.3

    CVE-2020-27768 · ImageMagick

    In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0.

    Published 23 Feb 2021 · Fixed in 7.0.9-0 · NVD
  34. Medium 5.9

    CVE-2021-27568 · Oracle WebLogic Server

    An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.

    Published 23 Feb 2021 · NVD
  35. Medium 5.3

    CVE-2020-29453 · Jira

    The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

    Published 22 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD
  36. Medium 5.3

    CVE-2020-29448 · Confluence

    The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

    Published 22 Feb 2021 · Fixed in 6.13.18, 7.4.6, 7.8.3 · NVD
  37. Medium 5.4

    CVE-2021-27279 · MyBB

    Nested Email MyCode Persistent XSS

    Published 22 Feb 2021 · Fixed in 1.8.25 · NVD, Project advisories (GitHub)
  38. High 7.2

    CVE-2021-21302 · PrestaShop

    CSV Injection via csv export

    Published 22 Feb 2021 · Fixed in 1.7.7.2 · NVD, Project advisories (GitHub)
  39. Critical 9.1

    CVE-2021-21308 · PrestaShop

    Improper session management for soft logout

    Published 22 Feb 2021 · Fixed in 1.7.7.2 · NVD, Project advisories (GitHub)
  40. High 7.5

    CVE-2021-26119 · Smarty

    Sandbox escape through template_object

    Published 21 Feb 2021 · Fixed in 3.1.39 · NVD, Project advisories (GitHub)
  41. Critical 9.8

    CVE-2021-26120 · Smarty

    PHP Code Injection by malicious function name

    Published 21 Feb 2021 · Fixed in 3.1.39 · NVD, Project advisories (GitHub)
  42. High

    GHSA-jw8j-qp56-25m2 · Metabase

    Possible SQL Injection With Redshift and Postgres Match and Replace Operations

    Published 19 Feb 2021 · Fixed in 0.36.11 · Project advisories (GitHub)
  43. High 7.8

    CVE-2021-27379 · Xen

    An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS crash) or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct. NOTE: this issue exists because of an incomplete fix for CVE-2020-15565.

    Published 18 Feb 2021 · Fixed in 4.12.0 · NVD
  44. High 7.5

    CVE-2020-28491 · Oracle WebLogic Server

    This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

    Published 18 Feb 2021 · NVD
  45. High 7.1

    CVE-2021-23340 · Pimcore

    This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename].…

    Published 18 Feb 2021 · Fixed in 6.8.8 · NVD
  46. High 7.5

    CVE-2021-20354 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 194883.

    Published 18 Feb 2021 · NVD
  47. High 8.1

    CVE-2020-8625 · BIND 9

    BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is…

    Published 17 Feb 2021 · NVD
  48. Medium 5.3

    CVE-2021-26697 · Apache Airflow

    The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.

    Published 17 Feb 2021 · NVD
  49. Medium 6.5

    CVE-2021-26559 · Apache Airflow

    Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

    Published 17 Feb 2021 · NVD
  50. Medium 5.5

    CVE-2021-26933 · Xen

    An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed.…

    Published 17 Feb 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.