UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
1,004
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Critical 9.8

    CVE-2021-22203 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5 · NVD
  2. Medium 4.3

    CVE-2021-22202 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.

    Published 2 Apr 2021 · NVD
  3. Medium 6.5

    CVE-2021-22201 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.

    Published 2 Apr 2021 · Fixed in 13.9.5, 13.10.1 · NVD
  4. High 7.5

    CVE-2021-22200 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5 · NVD
  5. Medium 4.3

    CVE-2021-22198 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  6. Medium 4.3

    CVE-2021-22197 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  7. Medium 5.4

    CVE-2021-22196 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.

    Published 2 Apr 2021 · Fixed in 13.8.7, 13.9.5, 13.10.1 · NVD
  8. Medium 4.3

    CVE-2021-26072 · Confluence

    The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

    Published 1 Apr 2021 · Fixed in 5.8.6 · NVD
  9. Low 3.7

    CVE-2021-22890 · curl

    curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a…

    Published 1 Apr 2021 · NVD
  10. Medium 5.3

    CVE-2021-22876 · curl

    curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the…

    Published 1 Apr 2021 · NVD
  11. High 7.5

    CVE-2021-28165 · Eclipse Jetty, Jenkins

    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

    Published 1 Apr 2021 · Fixed in 9.4.39, 10.0.2, 11.0.2 · NVD
  12. Medium 5.3

    CVE-2021-28164 · Eclipse Jetty

    In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

    Published 1 Apr 2021 · NVD
  13. Low 2.7

    CVE-2021-28163 · Apache Solr, Eclipse Jetty

    In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

    Published 1 Apr 2021 · Fixed in 9.4.39 · NVD
  14. Medium 4.3

    CVE-2021-22177 · GitLab

    Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.

    Published 1 Apr 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  15. Medium 4.3

    CVE-2021-3393 · PostgreSQL

    An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but…

    Published 1 Apr 2021 · Fixed in 11.11, 12.6, 13.2 · NVD
  16. Low 3.5

    CVE-2021-26071 · Jira

    The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.

    Published 1 Apr 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  17. Medium 5.3

    CVE-2020-36286 · Jira

    The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly visible issue field.

    Published 1 Apr 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  18. Medium 5.3

    CVE-2020-36238 · Jira

    The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check.

    Published 1 Apr 2021 · Fixed in 8.5.13, 8.13.5, 8.15.1 · NVD
  19. Medium 5.3

    CVE-2021-23007 · F5 BIG-IP

    On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · NVD
  20. High 7.5

    CVE-2021-23004 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  21. High 7.5

    CVE-2021-23003 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the Traffic Management Microkernel (TMM) process may produce a core file when undisclosed MPTCP traffic passes through a standard virtual server. Note: Software versions which have reached End of Software Development (EoSD) are not…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  22. Medium 4.5

    CVE-2021-23002 · F5 BIG-IP

    When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  23. Medium 4.3

    CVE-2021-23001 · F5 BIG-IP

    On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint. Note: Software versions which have reached End of…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  24. High 7.5

    CVE-2021-23000 · F5 BIG-IP

    On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD)…

    Published 31 Mar 2021 · Fixed in 13.1.3.6 · NVD
  25. High 7.5

    CVE-2021-22999 · F5 BIG-IP

    On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.0 · NVD
  26. Medium 5.3

    CVE-2021-22998 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  27. Medium 6.1

    CVE-2021-22994 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  28. Critical 9.8Actively exploited

    CVE-2021-22991 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  29. Critical 9.8

    CVE-2021-22992 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  30. High 7.2

    CVE-2021-22990 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages.…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  31. Critical 9.1

    CVE-2021-22989 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  32. Critical 9.9

    CVE-2021-22987 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions…

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  33. High 8.8

    CVE-2021-22988 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  34. Critical 9.8Actively exploited

    CVE-2021-22986 · F5 BIG-IP

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 31 Mar 2021 · Fixed in 14.1.4, 15.1.2.1, 16.0.1.1 · NVD
  35. High 7.8

    CVE-2020-24995 · FFmpeg

    Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local).

    Published 30 Mar 2021 · NVD
  36. Medium 5.4

    CVE-2021-21398 · PrestaShop

    Possible XSS injection through DataColumn Grid class

    Published 30 Mar 2021 · Fixed in 1.7.7.3 · NVD, Project advisories (GitHub)
  37. Medium 6.1

    CVE-2021-29274 · Redmine

    Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.

    Published 29 Mar 2021 · Fixed in 4.1.2 · NVD
  38. Medium

    GHSA-m8w4-6wxv-8v6m · Metabase

    Possible information leakage for Sandboxed users seeing filter list data they may not have access to

    Published 27 Mar 2021 · Project advisories (GitHub)
  39. Medium

    GHSA-pxfh-93j9-h745 · Metabase

    Revision API allows revert of dashboards and viewing history of questions/dashboards without permissions

    Published 27 Mar 2021 · Fixed in 0.37.11 · Project advisories (GitHub)
  40. Medium 4.4

    CVE-2021-22194 · GitLab

    In all versions of GitLab, marshalled session keys were being stored in Redis.

    Published 26 Mar 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  41. Medium 5.5

    CVE-2021-22184 · GitLab

    An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted.

    Published 26 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  42. Medium 4.3

    CVE-2021-22180 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.

    Published 26 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  43. Medium 4.3

    CVE-2021-22172 · GitLab

    Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page

    Published 26 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  44. Medium 6.1

    CVE-2021-22886 · Rocket.Chat

    Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

    Published 26 Mar 2021 · Fixed in 3.8.8, 3.9.7, 3.10.5 · NVD
  45. Medium 5.5

    CVE-2020-27829 · ImageMagick

    A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45.

    Published 26 Mar 2021 · Fixed in 7.0.10-45 · NVD
  46. Medium 5.4

    CVE-2020-19626 · Craft CMS

    Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.

    Published 26 Mar 2021 · NVD
  47. High 7.4

    CVE-2021-3450 · Node.js, OpenSSL, MySQL and 2 more

    The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a…

    Published 25 Mar 2021 · Fixed in 12.22.1, 14.16.1, 15.14.0 · NVD
  48. Medium 5.9

    CVE-2021-3449 · Node.js, OpenSSL, MySQL and 1 more

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server…

    Published 25 Mar 2021 · Fixed in 12.22.1, 14.16.1, 15.14.0 · NVD
  49. Unrated

    WPV-f217dbc5cf8c · Official Facebook Pixel (WordPress plugin)

    Vulnerability in Meta pixel for WordPress

    Published 25 Mar 2021 · Fixed in 3.0.0 · WPVulnerability
  50. Unrated

    WPV-3643b9d5bbd1 · Official Facebook Pixel (WordPress plugin)

    Vulnerability in Meta pixel for WordPress

    Published 25 Mar 2021 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.