UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,146
Published in 7 days
678
Critical in 30 days
355
Actively exploited
421

Latest vulnerabilities

39,146 vulnerabilities
  1. Medium 6.1

    CVE-2020-27729 · F5 BIG-IP

    In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on the BIG-IP APM virtual server allows a malicious user to build an open redirect URI.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  2. Medium 4.9

    CVE-2020-27727 · F5 BIG-IP

    On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1.1 · NVD
  3. Medium 6.1

    CVE-2020-27726 · F5 BIG-IP

    In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  4. High 7.5

    CVE-2020-27723 · F5 BIG-IP

    In versions 14.1.0-14.1.3 and 13.1.0-13.1.3.4, a BIG-IP APM virtual server processing PingAccess requests may lead to a restart of the Traffic Management Microkernel (TMM) process.

    Published 24 Dec 2020 · Fixed in 13.1.3.5, 14.1.3.1, 15.1.0 · NVD
  5. Medium 6.5

    CVE-2020-27722 · F5 BIG-IP

    In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing excessive resource consumption.

    Published 24 Dec 2020 · Fixed in 13.1.3.5, 14.1.3.1, 15.0.1.4 · NVD
  6. High 7.5

    CVE-2020-27720 · F5 BIG-IP

    On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port Block Allocation (PBA) mode and SP-DAG enabled, and dag-ipv6-prefix-len configured with a value less than the default of 128, an undisclosed traffic pattern may cause the Traffic Management Microkernel (TMM) to restart.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  7. Medium 6.1

    CVE-2020-27719 · F5 BIG-IP

    On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  8. High 7.5

    CVE-2020-27716 · F5 BIG-IP

    On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel (TMM) stops responding and restarts.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1 · NVD
  9. High 7.5

    CVE-2020-27715 · F5 BIG-IP

    On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU utilization by the httpd daemon.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1 · NVD
  10. Medium 6.5

    CVE-2020-27724 · F5 BIG-IP

    In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic over the tunnel.

    Published 24 Dec 2020 · Fixed in 15.0.1.4, 15.1.0.5, 16.0.1 · NVD
  11. High 7.2

    CVE-2020-35136 · Dolibarr ERP CRM

    Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.

    Published 23 Dec 2020 · NVD
  12. High 8.8

    CVE-2020-29396 · Odoo

    A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.

    Published 22 Dec 2020 · NVD
  13. Medium 4.3

    CVE-2019-11786 · Odoo

    Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify translated terms, which may lead to arbitrary content modification on translatable elements.

    Published 22 Dec 2020 · NVD
  14. Medium 4.3

    CVE-2019-11785 · Odoo

    Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages.

    Published 22 Dec 2020 · NVD
  15. Medium 6.5

    CVE-2019-11784 · Odoo

    Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to.

    Published 22 Dec 2020 · NVD
  16. Medium 6.5

    CVE-2019-11783 · Odoo

    Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to subscribe to arbitrary mail channels uninvited.

    Published 22 Dec 2020 · NVD
  17. Medium 6.5

    CVE-2019-11782 · Odoo

    Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation.

    Published 22 Dec 2020 · NVD
  18. High 8.8

    CVE-2019-11781 · Odoo

    Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims into modifying their account via crafted links, leading to privilege escalation.

    Published 22 Dec 2020 · NVD
  19. Medium 6.5

    CVE-2018-15645 · Odoo

    Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.

    Published 22 Dec 2020 · NVD
  20. Medium 5.4

    CVE-2018-15641 · Odoo

    Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

    Published 22 Dec 2020 · NVD
  21. Medium 5.4

    CVE-2018-15638 · Odoo

    Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.

    Published 22 Dec 2020 · NVD
  22. Medium 6.1

    CVE-2018-15634 · Odoo

    Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.

    Published 22 Dec 2020 · NVD
  23. Medium 6.1

    CVE-2018-15633 · Odoo

    Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.

    Published 22 Dec 2020 · NVD
  24. Critical 9.1

    CVE-2018-15632 · Odoo

    Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials.

    Published 22 Dec 2020 · NVD
  25. High 8.8

    CVE-2020-35626 · MediaWiki

    An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was completely vulnerable to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.

    Published 21 Dec 2020 · NVD
  26. High 8.8

    CVE-2020-35625 · MediaWiki

    An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.

    Published 21 Dec 2020 · NVD
  27. Medium 5.3

    CVE-2020-35624 · MediaWiki

    An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a full vote timestamp, which may provide unintended clues about how a voting process unfolded.

    Published 21 Dec 2020 · NVD
  28. High 7.5

    CVE-2020-35623 · MediaWiki

    An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or…

    Published 21 Dec 2020 · NVD
  29. Medium 6.1

    CVE-2020-35622 · MediaWiki

    An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap::makeForeignLink unsafely. The $page variable within the formatItem function was not being properly escaped, allowing for XSS under certain conditions.

    Published 21 Dec 2020 · NVD
  30. High 8.8

    CVE-2020-35606 · Webmin

    Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.

    Published 21 Dec 2020 · NVD
  31. High 7.7

    CVE-2020-17526 · Apache Airflow

    Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.

    Published 21 Dec 2020 · Fixed in 1.10.14 · NVD
  32. Medium 6.5

    CVE-2020-3999 · VMware ESXi

    VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx…

    Published 21 Dec 2020 · NVD
  33. Critical 9.8

    CVE-2020-27846 · Grafana

    A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

    Published 21 Dec 2020 · Fixed in 6.7.5, 7.2.3, 7.3.6 · NVD
  34. Medium

    CVE-2020-26284 · Hugo

    Hugo can execute a binary from the current directory on Windows

    Published 20 Dec 2020 · Fixed in 0.79.1 · Project advisories (GitHub)
  35. Medium 5.3

    CVE-2020-35480 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.

    Published 18 Dec 2020 · Fixed in 1.35.1 · NVD
  36. Medium 6.1

    CVE-2020-35479 · MediaWiki

    MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.

    Published 18 Dec 2020 · Fixed in 1.35.1 · NVD
  37. Medium 6.1

    CVE-2020-35478 · MediaWiki

    MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.

    Published 18 Dec 2020 · Fixed in 1.35.1 · NVD
  38. Medium 5.3

    CVE-2020-35477 · MediaWiki

    MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a…

    Published 18 Dec 2020 · Fixed in 1.35.1 · NVD
  39. High 7.5

    CVE-2020-35475 · MediaWiki

    In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)

    Published 18 Dec 2020 · Fixed in 1.35.1 · NVD
  40. Medium 6.1

    CVE-2020-35474 · MediaWiki

    In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML.

    Published 18 Dec 2020 · Fixed in 1.35.1 · NVD
  41. Medium 5.3

    CVE-2020-35453 · HashiCorp Vault

    HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.

    Published 17 Dec 2020 · Fixed in 1.5.6, 1.6.1 · NVD
  42. Medium 5.3

    CVE-2020-35177 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

    Published 17 Dec 2020 · Fixed in 1.5.6, 1.6.1 · NVD
  43. Medium 6.5

    CVE-2020-35123 · Zimbra Collaboration

    In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.

    Published 17 Dec 2020 · Fixed in 8.8.15 · NVD
  44. Critical 9.8

    CVE-2020-35192 · HashiCorp Vault

    The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

    Published 17 Dec 2020 · Fixed in 0.11.6 · NVD
  45. Medium 6.5

    CVE-2020-29436 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.

    Published 17 Dec 2020 · Fixed in 3.29.0 · NVD
  46. Unrated

    WPV-a26423547b6b · Contact Form 7

    Vulnerability in Contact Form 7

    Published 17 Dec 2020 · Fixed in 5.3.2 · WPVulnerability
  47. Critical 10.0

    CVE-2020-35489 · Contact Form 7

    Contact Form 7: Unrestricted Upload of File with Dangerous Type

    Published 17 Dec 2020 · Fixed in 5.3.2 · NVD, WPVulnerability
  48. Medium 6.8

    CVE-2020-26259 · Apache Struts

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on…

    Published 16 Dec 2020 · Fixed in 6.0.0 · NVD
  49. High 7.7

    CVE-2020-26258 · Apache Struts

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of…

    Published 16 Dec 2020 · Fixed in 6.0.0 · NVD
  50. Medium 6.0

    CVE-2020-29486 · Xen

    An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has quota implications. Any guest can run another guest out of quota, or create an unbounded number of nodes owned by dom0, thus running xenstored out of memory A malicious guest administrator can cause a denial of service against a specific…

    Published 15 Dec 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.