UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
1,004
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Medium 5.4

    CVE-2021-24201 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 17 Mar 2021 · Fixed in 3.1.4 · NVD, WPVulnerability
  2. Critical 9.8

    CVE-2020-24264 · Portainer

    Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine…

    Published 16 Mar 2021 · NVD
  3. High 8.8

    CVE-2020-24263 · Portainer

    Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host.

    Published 16 Mar 2021 · NVD
  4. Medium 5.4

    CVE-2021-21370 · TYPO3

    Cross-Site Scripting in Content Preview (CType menu)

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  5. Medium 5.4

    CVE-2021-21358 · TYPO3

    Cross-Site Scripting in Form Framework

    Published 16 Mar 2021 · Fixed in 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  6. High 8.3

    CVE-2021-21357 · TYPO3

    Broken Access Control in Form Framework

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  7. High 8.6

    CVE-2021-21355 · TYPO3

    Unrestricted File Upload in Form Framework

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  8. Medium 5.4

    CVE-2021-21340 · TYPO3

    Cross-Site Scripting in Content Preview (descriptionColumn)

    Published 16 Mar 2021 · Fixed in 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  9. High 7.5

    CVE-2021-21339 · TYPO3

    Cleartext storage of session identifier

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  10. Medium 6.1

    CVE-2021-21338 · TYPO3

    Open Redirection in Login Handling

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  11. High 7.5

    CVE-2021-21359 · TYPO3

    Denial of Service in Page Error Handling

    Published 16 Mar 2021 · Fixed in 9.5.25, 10.4.14, 11.1.1 · NVD, Project advisories (GitHub)
  12. High 7.2

    CVE-2021-24209 · WP Super Cache (WordPress plugin)

    WP Super Cache: Code Injection

    Published 16 Mar 2021 · Fixed in 1.7.2 · WPVulnerability
  13. Medium 4.3

    CVE-2021-20283 · Moodle

    The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD
  14. Medium 5.3

    CVE-2021-20282 · Moodle

    When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD
  15. Medium 5.3

    CVE-2021-20281 · Moodle

    It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD
  16. Medium 5.4

    CVE-2021-20280 · Moodle

    Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD
  17. Medium 5.4

    CVE-2021-20279 · Moodle

    The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

    Published 15 Mar 2021 · Fixed in 3.8.8, 3.9.5, 3.10.2 · NVD
  18. Medium 6.1

    CVE-2021-26924 · Argo CD

    An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.

    Published 15 Mar 2021 · Fixed in 1.7.12, 1.8.4 · NVD
  19. High 7.5

    CVE-2021-26923 · Argo CD

    An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication.

    Published 15 Mar 2021 · Fixed in 1.7.12, 1.8.4 · NVD
  20. Medium 5.4

    CVE-2021-28378 · Gitea

    Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

    Published 15 Mar 2021 · Fixed in 1.13.4 · NVD
  21. High 8.2

    CVE-2021-21378 · Envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the `allow_missing` requirement under `requires_any` due to a mistake in implementation. Envoy's JWT Authentication filter can be…

    Published 11 Mar 2021 · NVD
  22. Medium 6.1

    CVE-2021-27949 · MyBB

    Custom moderator tools reflected XSS

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  23. High 7.2

    CVE-2021-27948 · MyBB

    Usergroups SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  24. High 7.2

    CVE-2021-27947 · MyBB

    Forum Management SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  25. High 8.8

    CVE-2021-27946 · MyBB

    Poll vote count SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  26. High 8.8

    CVE-2021-27890 · MyBB

    Theme properties SQL injection

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  27. Medium 6.1

    CVE-2021-27889 · MyBB

    Nested Auto URL persistent XSS

    Published 10 Mar 2021 · Fixed in 1.8.26 · NVD, Project advisories (GitHub)
  28. Medium 6.5

    CVE-2020-5016 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary xml files on the system. This does not occur if Application security is enabled. IBM…

    Published 10 Mar 2021 · NVD
  29. High 7.5

    CVE-2021-21265 · October CMS

    Potential Host Header Poisoning on misconfigured servers

    Published 10 Mar 2021 · Fixed in 1.1.2 · NVD, Project advisories (GitHub)
  30. Medium 5.3

    CVE-2021-28116 · Squid

    SQUID-2020:12 Out-Of-Bounds memory access in WCCPv2

    Published 9 Mar 2021 · NVD, Project advisories (GitHub)
  31. Medium 5.5

    CVE-2021-20246 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 6.9.11-62, 7.0.10-62 · NVD
  32. Medium 5.5

    CVE-2021-20245 · ImageMagick

    A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 6.9.11-62, 7.0.10-62 · NVD
  33. Medium 5.5

    CVE-2021-20244 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 7.0.10-62 · NVD
  34. Medium 5.5

    CVE-2021-20243 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 7.0.10-62 · NVD
  35. Medium 5.5

    CVE-2021-20241 · ImageMagick

    A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

    Published 9 Mar 2021 · Fixed in 6.9.11-62, 7.0.10-62 · NVD
  36. Medium 4.3

    CVE-2021-22134 · Elasticsearch

    A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of…

    Published 8 Mar 2021 · NVD
  37. Medium 6.5

    CVE-2021-21362 · MinIO

    MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can…

    Published 8 Mar 2021 · Fixed in 2021-03-04t00-53-13z · NVD
  38. High 7.5

    CVE-2021-21327 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”. As an example of direct impact, this…

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  39. Medium 6.5

    CVE-2021-21326 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 it is possible to create tickets for another user with self-service interface without delegatee systems enabled. This is fixed in version 9.5.4.

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  40. Medium 4.8

    CVE-2021-21325 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting attack. To exploit this endpoint attacker need to be authenticated. This is fixed in version 9.5.4.

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  41. Medium 6.5

    CVE-2021-21324 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference (IDOR) on "Solutions". This vulnerability gives an unauthorized user the ability to enumerate GLPI items names (including users logins) using the knowbase search form (requires…

    Published 8 Mar 2021 · Fixed in 9.5.4 · NVD
  42. Medium

    GHSA-pjj4-jjgc-h3r8 · Shopware

    Authenticated remote code execution

    Published 8 Mar 2021 · Fixed in 6.3.5.2 · Project advisories (GitHub)
  43. High 7.5

    CVE-2021-32710 · Shopware

    Potential Session Hijacking

    Published 8 Mar 2021 · Fixed in 6.3.5.2 · NVD, Project advisories (GitHub)
  44. High 7.1

    CVE-2021-28041 · OpenSSH

    ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

    Published 5 Mar 2021 · Fixed in 8.5 · NVD
  45. Medium 5.4

    CVE-2021-27907 · Apache Superset

    Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the…

    Published 5 Mar 2021 · NVD
  46. Medium 6.1

    CVE-2021-25313 · Rancher

    A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.

    Published 5 Mar 2021 · Fixed in 2.5.6 · NVD
  47. Medium 6.3

    CVE-2021-21334 · containerd

    containerd CRI plugin: environment variables can leak between containers

    Published 5 Mar 2021 · Fixed in 1.3.10, 1.4.4 · NVD, Project advisories (GitHub)
  48. Medium 5.3

    CVE-2021-26029 · Joomla!

    An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  49. Medium 5.5

    CVE-2021-26028 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  50. Medium 5.3

    CVE-2021-26027 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.