UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,135
Published in 7 days
668
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,135 vulnerabilities
  1. Medium 5.4

    CVE-2021-26925 · Roundcube

    Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.

    Published 9 Feb 2021 · Fixed in 1.4.11 · NVD
  2. Medium 6.1

    CVE-2020-13947 · Apache ActiveMQ

    An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

    Published 8 Feb 2021 · Fixed in 5.15.14, 5.16.1 · NVD
  3. Medium 6.1

    CVE-2021-22122 · Fortinet FortiWeb

    An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.

    Published 8 Feb 2021 · NVD
  4. Low

    GHSA-jvg4-9rc2-wvcr · Shopware

    Generation of fake documents via public GET-call

    Published 8 Feb 2021 · Fixed in 6.3.5.1 · Project advisories (GitHub)
  5. High 7.5

    CVE-2021-32711 · Shopware

    Leak of information via Store-API

    Published 8 Feb 2021 · Fixed in 6.3.5.1 · NVD, Project advisories (GitHub)
  6. Medium 5.5

    CVE-2021-20176 · ImageMagick

    A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.

    Published 6 Feb 2021 · Fixed in 6.9.11-57, 7.0.10-56 · NVD
  7. High 7.5

    CVE-2021-3382 · Gitea

    Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.

    Published 5 Feb 2021 · NVD
  8. Critical 9.8

    CVE-2021-3311 · October CMS

    Session ID not invalidated after logout

    Published 5 Feb 2021 · Fixed in 1.0.472 · NVD, Project advisories (GitHub)
  9. High 7.1

    CVE-2021-25276 · SolarWinds Serv-U

    In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the…

    Published 3 Feb 2021 · Fixed in 15.2.2 · NVD
  10. Medium 5.4

    CVE-2020-8294 · Nextcloud

    A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.

    Published 3 Feb 2021 · Fixed in 18.0.11, 19.0.5, 20.0.2 · NVD
  11. Medium 5.3

    CVE-2021-25778 · TeamCity

    In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

    Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD
  12. Medium 5.3

    CVE-2021-25777 · TeamCity

    In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.

    Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD
  13. High 7.5

    CVE-2021-25776 · TeamCity

    In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.

    Published 3 Feb 2021 · Fixed in 2020.2 · NVD
  14. Low 3.8

    CVE-2021-25775 · TeamCity

    In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.

    Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD
  15. Medium 4.3

    CVE-2021-25774 · TeamCity

    In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.

    Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD
  16. Medium 6.1

    CVE-2021-25773 · TeamCity

    JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

    Published 3 Feb 2021 · Fixed in 2020.2 · NVD
  17. Medium 5.3

    CVE-2021-25772 · TeamCity

    In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.

    Published 3 Feb 2021 · Fixed in 2020.2.2 · NVD
  18. High 7.5

    CVE-2020-35667 · TeamCity

    JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.

    Published 3 Feb 2021 · Fixed in 2020.2.85695 · NVD
  19. Medium 5.4

    CVE-2020-35482 · SolarWinds Serv-U

    SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.

    Published 3 Feb 2021 · Fixed in 15.2.2 · NVD
  20. Critical 9.8

    CVE-2020-35481 · SolarWinds Serv-U

    SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.

    Published 3 Feb 2021 · Fixed in 15.2.2 · NVD
  21. Medium 5.4

    CVE-2020-28001 · SolarWinds Serv-U

    SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.

    Published 3 Feb 2021 · Fixed in 15.2.2 · NVD
  22. Medium 6.5

    CVE-2020-27994 · SolarWinds Serv-U

    SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.

    Published 3 Feb 2021 · Fixed in 15.2.2 · NVD
  23. Medium 5.3

    CVE-2020-29662 · Harbor

    In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.

    Published 2 Feb 2021 · Fixed in 2.0.5, 2.1.2 · NVD
  24. Medium 5.9

    CVE-2021-20199 · Podman

    Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.

    Published 2 Feb 2021 · Fixed in 3.0.0 · NVD
  25. High

    GHSA-x7p5-p2c9-phvg · Laravel

    Unexpected database bindings via requests (follow-up)

    Published 2 Feb 2021 · Fixed in 6.20.14 · Project advisories (GitHub)
  26. Medium 6.5

    CVE-2021-21285 · Docker Engine

    Docker daemon crash during image pull of malicious image

    Published 2 Feb 2021 · Fixed in 19.03.15, 20.10.3 · NVD, Project advisories (GitHub)
  27. Medium 6.8

    CVE-2021-21284 · Docker Engine

    Access to remapped root allows privilege escalation to real root

    Published 2 Feb 2021 · Fixed in 19.03.15, 20.10.3 · NVD, Project advisories (GitHub)
  28. Medium 4.3

    CVE-2020-36231 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.

    Published 2 Feb 2021 · Fixed in 8.5.10, 8.13.2 · NVD
  29. High 7.7

    CVE-2021-21287 · MinIO

    MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this…

    Published 1 Feb 2021 · Fixed in 2021-01-30t00-20-58z · NVD
  30. High 7.5

    CVE-2021-3282 · HashiCorp Vault

    HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

    Published 1 Feb 2021 · NVD
  31. Medium 5.3

    CVE-2021-3024 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

    Published 1 Feb 2021 · Fixed in 1.5.7, 1.6.2 · NVD
  32. High 8.8

    CVE-2021-21286 · AVideo

    AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.

    Published 1 Feb 2021 · Fixed in 10.2 · NVD
  33. Medium 5.3

    CVE-2020-25594 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

    Published 1 Feb 2021 · Fixed in 1.5.7, 1.6.2 · NVD
  34. High 7.5

    CVE-2020-29005 · MediaWiki

    The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure.

    Published 29 Jan 2021 · NVD
  35. High 8.8

    CVE-2020-29004 · MediaWiki

    The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.

    Published 29 Jan 2021 · NVD
  36. Medium 5.3

    CVE-2021-20185 · Moodle

    It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.

    Published 28 Jan 2021 · Fixed in 3.5.16, 3.8.7, 3.9.4 · NVD
  37. High 7.2

    CVE-2021-20187 · Moodle

    It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.

    Published 28 Jan 2021 · Fixed in 3.5.16, 3.8.7, 3.9.4 · NVD
  38. Medium 5.4

    CVE-2021-20186 · Moodle

    It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.

    Published 28 Jan 2021 · Fixed in 3.8.7, 3.9.4, 3.10.1 · NVD
  39. Medium 4.3

    CVE-2021-20184 · Moodle

    It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades.

    Published 28 Jan 2021 · Fixed in 3.8.7, 3.9.4, 3.10.1 · NVD
  40. Medium 5.4

    CVE-2021-20183 · Moodle

    It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries.

    Published 28 Jan 2021 · Fixed in 3.10.1 · NVD
  41. Critical 9.6

    CVE-2020-35124 · Mautic

    A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.

    Published 28 Jan 2021 · Fixed in 3.2.4 · NVD
  42. High 7.5

    CVE-2021-3326 · GNU C Library

    The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

    Published 27 Jan 2021 · NVD
  43. High 7.5

    CVE-2021-26118 · Apache ActiveMQ Artemis

    While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

    Published 27 Jan 2021 · NVD
  44. High 7.5

    CVE-2021-26117 · Apache ActiveMQ, Apache ActiveMQ Artemis

    The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

    Published 27 Jan 2021 · Fixed in 2.16.0, 5.15.14, 5.16.1 · NVD
  45. High 7.8Actively exploited

    CVE-2021-3156 · sudo

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

    Published 26 Jan 2021 · Fixed in 1.8.32, 1.9.5 · NVD
  46. Medium 5.5

    CVE-2021-3308 · Xen

    An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector…

    Published 26 Jan 2021 · NVD
  47. Critical 9.8

    CVE-2021-3193 · Nagios XI

    Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.

    Published 26 Jan 2021 · NVD
  48. High 7.5

    CVE-2021-26267 · cPanel & WHM

    cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).

    Published 26 Jan 2021 · Fixed in 92.0.9 · NVD
  49. High 7.5

    CVE-2021-26266 · cPanel & WHM

    cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).

    Published 26 Jan 2021 · Fixed in 92.0.9 · NVD
  50. Medium 5.3

    CVE-2021-21615 · Jenkins

    Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

    Published 26 Jan 2021 · Fixed in 2.263.3, 2.276 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.