Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,146
- Published in 7 days
- 678
- Critical in 30 days
- 355
- Actively exploited
- 421
Latest vulnerabilities
39,146 vulnerabilities- Medium 5.5
CVE-2020-29485 · Xen
An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable.
Published 15 Dec 2020 · NVD - Medium 6.0
CVE-2020-29484 · Xen
An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch, and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages, consisting of a message header and the…
Published 15 Dec 2020 · NVD - Medium 6.5
CVE-2020-29483 · Xen
An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately, this is done by just removing the guest from xenstored's internal management, resulting in the same actions as if the guest had been destroyed, including sending an…
Published 15 Dec 2020 · NVD - Medium 6.0
CVE-2020-29482 · Xen
An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily using absolute paths. oxenstored imposes a pathname limit that is applied solely to the relative or…
Published 15 Dec 2020 · NVD - High 8.8
CVE-2020-29481 · Xen
An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed when a domain is being destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes from the previous domain(s) with the same domid. Because all Xenstore entries of a guest below…
Published 15 Dec 2020 · NVD - Low 2.3
CVE-2020-29480 · Xen
An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest administrator can also use the special watches, which will cause a notification every time a domain is created…
Published 15 Dec 2020 · NVD - High 8.8
CVE-2020-29479 · Xen
An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root node, because this node has no parent. Unfortunately, permissions were not checked for certain operations on the root node. Unprivileged guests can get and modify permissions, list, and delete the root node. (Deleting the whole xenstore tree…
Published 15 Dec 2020 · NVD - Medium 6.2
CVE-2020-29571 · Xen
An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes, the consumer side isn't protected against re-ordered reads, and may hence end up de-referencing a NULL pointer. Malicious or buggy guest kernels can mount a…
Published 15 Dec 2020 · NVD - Medium 6.2
CVE-2020-29570 · Xen
An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system.
Published 15 Dec 2020 · NVD - High 8.8
CVE-2020-29569 · Xen
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was…
Published 15 Dec 2020 · NVD - Medium 6.5
CVE-2020-29568 · Xen
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.
Published 15 Dec 2020 · NVD - Medium 6.2
CVE-2020-29567 · Xen
An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-allocated on the relevant CPUs. De-allocation has to happen when certain constraints are met. If these conditions are not met when first checked, the checking CPU may send an interrupt to itself, in the expectation that this IRQ will be…
Published 15 Dec 2020 · NVD - Medium 5.5
CVE-2020-29566 · Xen
An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation, via an event channel, so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation, the de-schedule /…
Published 15 Dec 2020 · NVD - Low
GHSA-cq6h-w3mc-57f4 · Shopware
Information exposure via query strings in URL
Published 15 Dec 2020 · Fixed in 6.3.4.1 · Project advisories (GitHub) - Low
GHSA-8pfh-mm2g-hmc3 · Shopware
Authenticated Server Side Request Forgery
Published 15 Dec 2020 · Fixed in 6.3.4.1 · Project advisories (GitHub) - Low
GHSA-5q58-x5h2-v5rx · Shopware
Authenticated Privilege Escalation
Published 15 Dec 2020 · Fixed in 6.3.4.1 · Project advisories (GitHub) - High 7.5
CVE-2020-35471 · Envoy
Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500.
Published 15 Dec 2020 · Fixed in 1.16.1 · NVD - High 8.8
CVE-2020-35470 · Envoy
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).
Published 15 Dec 2020 · Fixed in 1.16.1 · NVD - High 7.5
CVE-2020-8286 · curl
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Published 14 Dec 2020 · Fixed in 7.74.0 · NVD - High 7.5
CVE-2020-8285 · curl
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Published 14 Dec 2020 · Fixed in 7.74.0 · NVD - Low 3.7
CVE-2020-8284 · curl
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Published 14 Dec 2020 · NVD - High 7.5
CVE-2020-8231 · curl
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
Published 14 Dec 2020 · NVD - High 7.8
CVE-2020-8177 · curl
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
Published 14 Dec 2020 · NVD - High 7.5
CVE-2020-8169 · curl
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
Published 14 Dec 2020 · NVD - Medium 5.3
CVE-2020-17513 · Apache Airflow
In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.
Published 14 Dec 2020 · Fixed in 1.10.13 · NVD - Medium 6.5
CVE-2020-17511 · Apache Airflow
In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.
Published 14 Dec 2020 · Fixed in 1.10.13 · NVD - Medium 5.3
CVE-2020-35175 · Frappe Framework
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.
Published 11 Dec 2020 · NVD - High 7.5
CVE-2020-5949 · F5 BIG-IP
On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break.
Published 11 Dec 2020 · Fixed in 13.1.3.5, 14.1.0 · NVD - Critical 9.6
CVE-2020-5948 · F5 BIG-IP
On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
Published 11 Dec 2020 · Fixed in 13.1.3.5, 14.1.2.8, 15.1.1 · NVD - High 7.5
CVE-2020-27508 · Frappe Framework
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security.
Published 11 Dec 2020 · Fixed in 12.10.0 · NVD - Low 3.5
CVE-2020-28838 · OpenCart
Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.
Published 11 Dec 2020 · NVD - Medium 6.1
CVE-2020-17515 · Apache Airflow
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Published 11 Dec 2020 · Fixed in 1.10.15, 2.0.2 · NVD - Medium 4.3
CVE-2020-26411 · GitLab
A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.3
CVE-2020-26417 · GitLab
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.4
CVE-2020-26416 · GitLab
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.3
CVE-2020-26415 · GitLab
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.3
CVE-2020-26413 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.
Published 11 Dec 2020 · Fixed in 13.6.2 · NVD - Medium 4.3
CVE-2020-26412 · GitLab
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.
Published 11 Dec 2020 · Fixed in 13.6.2 · NVD - Medium 5.3
CVE-2020-26408 · GitLab
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker to view limited information in user's private profile
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.3
CVE-2020-13357 · GitLab
An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 6.5
CVE-2020-26409 · GitLab
A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - High 7.2
CVE-2020-24637 · HPE ArubaOS
Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and…
Published 11 Dec 2020 · Fixed in 8.5.0.11, 8.6.0.6, 8.7.1.0 · NVD - Critical 9.8
CVE-2020-24634 · HPE ArubaOS
An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10,…
Published 11 Dec 2020 · Fixed in 8.5.0.11, 8.6.0.6, 8.7.1.0 · NVD - Critical 9.8
CVE-2020-24633 · HPE ArubaOS
There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below;…
Published 11 Dec 2020 · Fixed in 8.5.0.11, 8.6.0.6, 8.7.1.0 · NVD - Critical 9.8Actively exploited
CVE-2020-17530 · Apache Struts
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Published 11 Dec 2020 · Fixed in 2.5.30 · NVD - Low 3.3
CVE-2020-8908 · Oracle WebLogic Server
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has…
Published 10 Dec 2020 · NVD - Medium 5.4
CVE-2020-26407 · GitLab
A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project
Published 10 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Critical 9.0
CVE-2020-24445 · Adobe Experience Manager
AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 10 Dec 2020 · NVD - High 8.4Actively exploited
CVE-2020-17144 · Microsoft Exchange Server
Microsoft Exchange Remote Code Execution Vulnerability
Published 10 Dec 2020 · NVD - High 8.8
CVE-2020-17143 · Microsoft Exchange Server
Microsoft Exchange Server Information Disclosure Vulnerability
Published 10 Dec 2020 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.