UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
1,004
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. High 7.1

    CVE-2026-66705 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Cross-site Scripting

    Published 25 Mar 2021 · Fixed in 5.2.2 · WPVulnerability
  2. High 8.8

    CVE-2021-24218 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Cross-Site Request Forgery (CSRF)

    Published 25 Mar 2021 · WPVulnerability
  3. High 8.1

    CVE-2021-24217 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Deserialization of Untrusted Data

    Published 25 Mar 2021 · Fixed in 3.0.0 · WPVulnerability
  4. Medium 4.3

    CVE-2021-22169 · GitLab

    An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.

    Published 24 Mar 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  5. Low 3.5

    CVE-2021-22193 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.

    Published 24 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  6. High 8.8

    CVE-2021-22192 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.

    Published 24 Mar 2021 · Fixed in 13.7.9, 13.8.6, 13.9.4 · NVD
  7. Medium 4.9

    CVE-2021-22186 · GitLab

    An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners

    Published 24 Mar 2021 · Fixed in 13.7.8, 13.8.5, 13.9.2 · NVD
  8. Medium 5.4

    CVE-2021-22185 · GitLab

    Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki

    Published 24 Mar 2021 · Fixed in 13.8.5, 13.9.2 · NVD
  9. Medium 5.4

    CVE-2021-22179 · GitLab

    A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.

    Published 24 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  10. Medium 5.0

    CVE-2021-22178 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.

    Published 24 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  11. Medium 4.3

    CVE-2021-22176 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

    Published 24 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  12. Medium 5.5

    CVE-2021-20227 · SQLite

    A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

    Published 23 Mar 2021 · Fixed in 3.34.1 · NVD
  13. Critical 9.1

    CVE-2021-21351 · Apache ActiveMQ, MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  14. Critical 9.8

    CVE-2021-21350 · Apache ActiveMQ, Oracle WebLogic Server

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  15. High 8.6

    CVE-2021-21349 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  16. High 7.5

    CVE-2021-21348 · Apache ActiveMQ, MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  17. Critical 9.8

    CVE-2021-21347 · Apache ActiveMQ, Oracle WebLogic Server

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  18. Critical 9.8

    CVE-2021-21346 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  19. Critical 9.9

    CVE-2021-21345 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  20. Critical 9.8

    CVE-2021-21344 · Apache ActiveMQ, MySQL

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  21. High 7.5

    CVE-2021-21343 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  22. Critical 9.1

    CVE-2021-21342 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  23. High 7.5

    CVE-2021-21341 · Apache ActiveMQ

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the…

    Published 23 Mar 2021 · Fixed in 5.15.14 · NVD
  24. Medium 6.1

    CVE-2021-24891 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 23 Mar 2021 · Fixed in 3.1.4, 3.4.8, 3.6.3 · NVD, WPVulnerability
  25. Medium 4.4

    CVE-2021-27908 · Mautic

    Secret data exfiltration via symfony parameters

    Published 22 Mar 2021 · Fixed in 3.3.2 · NVD, Project advisories (GitHub)
  26. High 7.5

    CVE-2021-28148 · Grafana

    One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.

    Published 22 Mar 2021 · Fixed in 6.7.6, 7.3.10, 7.4.5 · NVD
  27. Medium 6.5

    CVE-2021-28147 · Grafana

    The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions…

    Published 22 Mar 2021 · Fixed in 6.7.6, 7.3.10, 7.4.5 · NVD
  28. Medium 6.5

    CVE-2021-28146 · Grafana

    The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.

    Published 22 Mar 2021 · Fixed in 7.4.5 · NVD
  29. High 7.1

    CVE-2021-27962 · Grafana

    Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.

    Published 22 Mar 2021 · Fixed in 7.3.10, 7.4.5 · NVD
  30. Critical 9.8

    CVE-2021-26295 · Apache OFBiz

    Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

    Published 22 Mar 2021 · Fixed in 17.12.06 · NVD
  31. High 7.2

    CVE-2021-26070 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

    Published 22 Mar 2021 · Fixed in 8.13.3, 8.14.1 · NVD
  32. Medium 5.3

    CVE-2021-26069 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/{id}/ActionsAndOperations API endpoint. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.

    Published 22 Mar 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD
  33. Medium 6.1

    CVE-2019-14831 · Moodle

    A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.

    Published 19 Mar 2021 · NVD
  34. Medium 6.1

    CVE-2019-14830 · Moodle

    A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is…

    Published 19 Mar 2021 · NVD
  35. Medium 4.3

    CVE-2019-14829 · Moodle

    A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.

    Published 19 Mar 2021 · NVD
  36. Medium 4.3

    CVE-2019-14828 · Moodle

    A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.

    Published 19 Mar 2021 · NVD
  37. High 7.8

    CVE-2019-10128 · PostgreSQL

    A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read…

    Published 19 Mar 2021 · Fixed in 9.6.13, 10.8, 11.3 · NVD
  38. High 8.8

    CVE-2019-10127 · PostgreSQL

    A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL…

    Published 19 Mar 2021 · Fixed in 9.6.13, 10.8, 11.3 · NVD
  39. Medium 5.9

    CVE-2021-21390 · MinIO

    MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies…

    Published 19 Mar 2021 · Fixed in 2021-03-17t02-33-02z · NVD
  40. Medium 5.5

    CVE-2021-27506 · ClamAV

    The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.

    Published 19 Mar 2021 · NVD
  41. High 7.2

    CVE-2021-27928 · MariaDB

    A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this…

    Published 19 Mar 2021 · Fixed in 10.3.28, 10.4.18, 10.5.9 · NVD
  42. High 8.1

    CVE-2021-27221 · MikroTik RouterOS

    MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work

    Published 19 Mar 2021 · NVD
  43. High 7.5

    CVE-2021-27358 · Grafana

    The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

    Published 18 Mar 2021 · NVD
  44. Medium 5.4

    CVE-2021-28145 · Concrete CMS

    Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

    Published 18 Mar 2021 · Fixed in 8.5.5 · NVD
  45. Unrated

    WPV-c9c9e938ba16 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 17 Mar 2021 · Fixed in 3.1.4 · WPVulnerability
  46. Medium 5.4

    CVE-2021-24206 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  47. Medium 5.4

    CVE-2021-24205 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  48. Medium 5.4

    CVE-2021-24204 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  49. Medium 5.4

    CVE-2021-24203 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  50. Medium 5.4

    CVE-2021-24202 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.