Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,135
- Published in 7 days
- 669
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,135 vulnerabilities- Medium 5.9
CVE-2021-23841 · OpenSSL, MySQL
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref…
Published 16 Feb 2021 · Fixed in 1.1.1j, 5.7.33, 8.0.23 · NVD - High 7.5
CVE-2021-23840 · Node.js, OpenSSL, MySQL
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave…
Published 16 Feb 2021 · Fixed in 10.24.0, 12.21.0, 15.10.0 · NVD - Low 3.7
CVE-2021-23839 · OpenSSL
OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is…
Published 16 Feb 2021 · NVD - Medium 5.4
CVE-2021-27231 · Hestia Control Panel
Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages.
Published 16 Feb 2021 · NVD - High 8.8
CVE-2020-24899 · Nagios XI
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.
Published 15 Feb 2021 · NVD - High 7.2
CVE-2020-22427 · Nagios XI
NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later…
Published 15 Feb 2021 · NVD - Medium 6.1
CVE-2021-25299 · Nagios XI
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution…
Published 15 Feb 2021 · NVD - High 8.8Actively exploited
CVE-2021-25298 · Nagios XI
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
Published 15 Feb 2021 · NVD - High 8.8Actively exploited
CVE-2021-25297 · Nagios XI
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
Published 15 Feb 2021 · NVD - High 8.8Actively exploited
CVE-2021-25296 · Nagios XI
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
Published 15 Feb 2021 · NVD - Medium 5.9
CVE-2021-23336 · Python
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation…
Published 15 Feb 2021 · Fixed in 3.7.10, 3.8.8, 3.9.2 · NVD - High 7.5
CVE-2021-21702 · PHP
In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.
Published 15 Feb 2021 · Fixed in 7.3.27, 7.4.15, 8.0.2 · NVD - Medium 5.3
CVE-2020-7071 · PHP
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.
Published 15 Feb 2021 · Fixed in 7.3.26, 7.4.14, 8.0.1 · NVD - Medium 4.3
CVE-2020-29451 · Jira
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1.
Published 15 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.14.1 · NVD - Medium 5.3
CVE-2020-36237 · Jira
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0.
Published 15 Feb 2021 · Fixed in 8.15.0 · NVD - Medium 6.1
CVE-2020-36236 · Jira
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
Published 15 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD - Medium 5.3
CVE-2020-36235 · Jira
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1.
Published 15 Feb 2021 · Fixed in 8.13.2, 8.14.1 · NVD - Medium 4.8
CVE-2020-36234 · Jira
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
Published 15 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD - Critical 9.8
CVE-2019-25019 · LimeSurvey
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.
Published 14 Feb 2021 · Fixed in 3.19.0 · NVD - High 8.3
CVE-2021-22978 · F5 BIG-IP
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are…
Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD - High 7.5
CVE-2021-22977 · F5 BIG-IP
On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Published 12 Feb 2021 · Fixed in 14.1.3.1, 16.0.1.1 · NVD - Medium 4.8
CVE-2021-22981 · F5 BIG-IP
On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not…
Published 12 Feb 2021 · NVD - High 7.8
CVE-2021-22980 · F5 BIG-IP
In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on…
Published 12 Feb 2021 · Fixed in 13.1.3.6, 16.0.1.1 · NVD - Medium 6.1
CVE-2021-22979 · F5 BIG-IP
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note:…
Published 12 Feb 2021 · Fixed in 14.1.2.8, 15.1.1, 16.0.1 · NVD - High 7.5
CVE-2021-22975 · F5 BIG-IP
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.2.1, 16.0.1.1 · NVD - High 7.5
CVE-2021-22974 · F5 BIG-IP
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for…
Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.2, 16.0.1.1 · NVD - High 7.5
CVE-2021-22973 · F5 BIG-IP
On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.2, 16.0.1.1 · NVD - High 7.2Actively exploited
CVE-2021-21311 · Adminer
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
Published 11 Feb 2021 · Fixed in 4.7.9 · NVD - Critical 9.1
CVE-2021-21014 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.6
CVE-2021-21032 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.6
CVE-2021-21031 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - High 8.1
CVE-2021-21030 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 4.8
CVE-2021-21029 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 4.3
CVE-2021-21027 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.3
CVE-2021-21026 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21025 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21024 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 4.8
CVE-2021-21023 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.3
CVE-2021-21022 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.3
CVE-2021-21020 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21019 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21018 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21016 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - High 8.0
CVE-2021-21015 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - High 7.0
CVE-2021-20188 · Podman
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means…
Published 11 Feb 2021 · Fixed in 1.7.0 · NVD - Medium 4.9
CVE-2020-7021 · Elasticsearch
Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.
Published 10 Feb 2021 · Fixed in 6.8.14, 7.10.0 · NVD - High 8.2
CVE-2021-20353 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.
Published 10 Feb 2021 · Fixed in 8.0.0.15, 8.5.5.20, 9.0.5.7 · NVD - Critical 9.6
CVE-2020-35125 · Mautic
A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept).
Published 9 Feb 2021 · Fixed in 2.16.5, 3.2.4 · NVD - Medium 6.1
CVE-2020-35572 · Adminer
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.
Published 9 Feb 2021 · NVD - Medium 6.5
CVE-2021-26921 · Argo CD
In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.
Published 9 Feb 2021 · Fixed in 1.7.12, 1.8.4 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.