Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,135
- Published in 7 days
- 668
- Critical in 30 days
- 357
- Actively exploited
- 421
Latest vulnerabilities
39,135 vulnerabilities- Medium 5.3
CVE-2021-2006 · MySQL
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…
Published 20 Jan 2021 · NVD - Medium 4.9
CVE-2021-2002 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 20 Jan 2021 · NVD - Medium 4.9
CVE-2021-2001 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.50 and prior, 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…
Published 20 Jan 2021 · NVD - Low 3.8
CVE-2021-1998 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of…
Published 20 Jan 2021 · NVD - Low 2.4
CVE-2021-1996 · Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker.…
Published 20 Jan 2021 · NVD - Medium 6.5
CVE-2021-1995 · Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or…
Published 20 Jan 2021 · NVD - Critical 9.8
CVE-2021-1994 · Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.…
Published 20 Jan 2021 · NVD - Critical 9.8
CVE-2021-3110 · PrestaShop
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
Published 20 Jan 2021 · NVD - Medium 6.1
CVE-2021-24241 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)
Advanced Custom Field Pro: Cross-site Scripting
Published 20 Jan 2021 · Fixed in 5.9.1 · NVD, WPVulnerability - Critical 9.0
CVE-2020-35128 · Mautic
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a…
Published 19 Jan 2021 · Fixed in 2.16.5, 3.2.4 · NVD - Medium
CVE-2018-10189 · Mautic
Sessions could be hijacked due to tracking contacts by an auto-incremented ID
Published 19 Jan 2021 · Fixed in 2.13.0 · Project advisories (GitHub) - Medium
CVE-2018-8092 · Mautic
CSV Injection vulnerability with exported contact lists
Published 19 Jan 2021 · Fixed in 2.13.0 · Project advisories (GitHub) - Critical 9.8
CVE-2021-3177 · Python
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
Published 19 Jan 2021 · NVD - Medium 6.5
CVE-2020-29450 · Confluence
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0.
Published 19 Jan 2021 · Fixed in 7.2.0 · NVD - High
GHSA-6fcp-57cp-fww9 · Metabase
Metabase Enterprise Data Sandboxing and Caching Visibility Vulnerability
Published 18 Jan 2021 · Fixed in 0.37.6 · Project advisories (GitHub) - High 7.5Actively exploited
CVE-2020-36193 · Drupal
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Published 18 Jan 2021 · Fixed in 8.9.13, 9.0.11, 9.1.3 · NVD - High 7.8
CVE-2021-3162 · Docker Engine
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
Published 15 Jan 2021 · Fixed in 2.5.0.0 · NVD - Medium 6.5
CVE-2021-22171 · GitLab
Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - Medium 6.5
CVE-2021-22168 · GitLab
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - High 7.5
CVE-2021-22167 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - High 7.5
CVE-2021-22166 · GitLab
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method
Published 15 Jan 2021 · Fixed in 13.7.2 · NVD - Medium 6.5
CVE-2020-26414 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string.
Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD - High
CVE-2021-21263 · Laravel
Query Binding Exploitation
Published 15 Jan 2021 · Fixed in 6.20.12 · Project advisories (GitHub) - High 7.5
CVE-2020-35733 · Erlang/OTP
An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.
Published 15 Jan 2021 · Fixed in 23.2.2 · NVD - Medium 4.8
CVE-2021-22132 · Elasticsearch
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Published 14 Jan 2021 · Fixed in 7.10.2 · NVD - Medium 5.3
CVE-2020-29019 · Fortinet FortiWeb
A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request with a crafted cookie header.
Published 14 Jan 2021 · Fixed in 6.2.4 · NVD - High 8.8
CVE-2020-29018 · Fortinet FortiWeb
A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.
Published 14 Jan 2021 · NVD - Critical 9.8
CVE-2020-29016 · Fortinet FortiWeb
A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentially execute arbitrary code by sending a crafted request with a large certname.
Published 14 Jan 2021 · Fixed in 6.2.4 · NVD - Critical 9.8
CVE-2020-29015 · Fortinet FortiWeb
A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.
Published 14 Jan 2021 · Fixed in 6.2.4 · NVD - Medium 5.9
CVE-2021-24122 · Apache Tomcat
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the…
Published 14 Jan 2021 · NVD - High 7.5
CVE-2021-3138 · Discourse
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.
Published 14 Jan 2021 · NVD - High 8.1
CVE-2021-21013 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.
Published 13 Jan 2021 · NVD - Medium 5.3
CVE-2021-21012 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.
Published 13 Jan 2021 · NVD - High 7.2
CVE-2020-35578 · Nagios XI
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
Published 13 Jan 2021 · Fixed in 5.8.0 · NVD - Medium 4.4
CVE-2021-3032 · Palo Alto Networks PAN-OS
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in…
Published 13 Jan 2021 · Fixed in 9.0.12, 9.1.4, 10.0.1 · NVD - Medium 4.3
CVE-2021-3031 · Palo Alto Networks PAN-OS
Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect…
Published 13 Jan 2021 · Fixed in 8.1.18, 9.0.12, 9.1.5 · NVD - Medium 5.4
CVE-2021-21611 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.
Published 13 Jan 2021 · NVD - Medium 6.1
CVE-2021-21610 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.
Published 13 Jan 2021 · NVD - Medium 5.3
CVE-2021-21609 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.
Published 13 Jan 2021 · NVD - Medium 5.4
CVE-2021-21608 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.
Published 13 Jan 2021 · NVD - Medium 6.5
CVE-2021-21607 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.
Published 13 Jan 2021 · NVD - Medium 4.3
CVE-2021-21606 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.
Published 13 Jan 2021 · NVD - High 8.0
CVE-2021-21605 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.
Published 13 Jan 2021 · NVD - High 8.0
CVE-2021-21604 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.
Published 13 Jan 2021 · NVD - Medium 5.4
CVE-2021-21603 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
Published 13 Jan 2021 · NVD - Medium 6.5
CVE-2021-21602 · Jenkins
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
Published 13 Jan 2021 · NVD - Medium 6.1
CVE-2021-23125 · Joomla!
An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.
Published 12 Jan 2021 · NVD - Medium 6.1
CVE-2021-23124 · Joomla!
An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.
Published 12 Jan 2021 · NVD - Medium 5.3
CVE-2021-23123 · Joomla!
An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules.
Published 12 Jan 2021 · NVD - High 7.5
CVE-2021-1723 · .NET
ASP.NET Core and Visual Studio Denial of Service Vulnerability
Published 12 Jan 2021 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.