UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
1,004
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. High 7.5

    CVE-2021-23132 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  2. High 7.5

    CVE-2021-23131 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  3. Medium 6.1

    CVE-2021-23130 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  4. Medium 6.1

    CVE-2021-23129 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  5. Critical 9.1

    CVE-2021-23128 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  6. Critical 9.1

    CVE-2021-23127 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  7. Medium 5.3

    CVE-2021-23126 · Joomla!

    An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.

    Published 4 Mar 2021 · Fixed in 3.9.25 · NVD
  8. Medium 4.3

    CVE-2021-22128 · Fortinet FortiProxy

    An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.

    Published 4 Mar 2021 · NVD
  9. High 7.5

    CVE-2020-15938 · Fortinet FortiOS

    When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header.

    Published 4 Mar 2021 · NVD
  10. High 7.2

    CVE-2021-22189 · GitLab

    Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.

    Published 4 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  11. Medium 5.4

    CVE-2021-22183 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.

    Published 4 Mar 2021 · Fixed in 13.6.6, 13.7.6, 13.8.2 · NVD
  12. High 8.6

    CVE-2020-25097 · Squid

    SQUID-2020:11 HTTP Request Smuggling

    Published 4 Mar 2021 · Fixed in 4.14, 5.0.5 · NVD, Project advisories (GitHub)
  13. Medium 4.8

    CVE-2021-21314 · GLPI

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.

    Published 3 Mar 2021 · Fixed in 9.5.4 · NVD
  14. Medium 6.1

    CVE-2021-21313 · GLPI

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which…

    Published 3 Mar 2021 · Fixed in 9.5.4 · NVD
  15. Medium 4.8

    CVE-2021-21312 · GLPI

    GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: "Web Link" is not properly sanitized and a malicious…

    Published 3 Mar 2021 · Fixed in 9.5.4 · NVD
  16. High 7.5

    CVE-2021-22884 · Node.js

    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the…

    Published 3 Mar 2021 · Fixed in 12.21.0, 14.16.0, 15.10.0 · NVD
  17. High 7.5

    CVE-2021-22883 · Node.js

    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file…

    Published 3 Mar 2021 · Fixed in 12.21.0, 14.16.0, 15.10.0 · NVD
  18. Medium 4.8

    CVE-2021-22878 · Nextcloud

    Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

    Published 3 Mar 2021 · Fixed in 20.0.6 · NVD
  19. Medium 6.5

    CVE-2021-22877 · Nextcloud

    A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet.

    Published 3 Mar 2021 · Fixed in 20.0.6 · NVD
  20. Medium 5.3

    CVE-2021-22188 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs.

    Published 3 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  21. Medium 5.4

    CVE-2021-22182 · GitLab

    An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.

    Published 3 Mar 2021 · Fixed in 13.7.6, 13.8.2 · NVD
  22. Medium 6.7

    CVE-2020-8296 · Nextcloud

    Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.

    Published 3 Mar 2021 · Fixed in 20.0.0 · NVD
  23. High 8.8

    CVE-2021-27927 · Zabbix

    In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL…

    Published 3 Mar 2021 · NVD
  24. Medium 6.1

    CVE-2020-15937 · Fortinet FortiOS

    An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard.

    Published 3 Mar 2021 · Fixed in 6.2.5, 6.4.1 · NVD
  25. Medium 4.8

    CVE-2021-23347 · Argo CD

    The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

    Published 3 Mar 2021 · Fixed in 1.7.13, 1.8.6 · NVD
  26. Critical 9.1

    CVE-2021-27078 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  27. High 7.8Actively exploited

    CVE-2021-27065 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  28. High 7.8Actively exploited

    CVE-2021-26858 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  29. High 7.8Actively exploited

    CVE-2021-26857 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  30. Critical 9.1Actively exploited

    CVE-2021-26855 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  31. Medium 6.6

    CVE-2021-26854 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  32. Critical 9.1

    CVE-2021-26412 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Mar 2021 · NVD
  33. Medium 5.4

    CVE-2021-21258 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.

    Published 2 Mar 2021 · Fixed in 9.5.4 · NVD
  34. Medium 5.7

    CVE-2021-21255 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4.

    Published 2 Mar 2021 · NVD
  35. Medium 4.3

    CVE-2021-22187 · GitLab

    An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.

    Published 2 Mar 2021 · Fixed in 13.6.7, 13.7.7, 13.8.4 · NVD
  36. Medium 4.9

    CVE-2018-25004 · MongoDB

    A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

    Published 1 Mar 2021 · Fixed in 3.6.11, 4.0.6 · NVD
  37. Medium 6.5

    CVE-2020-7929 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.

    Published 1 Mar 2021 · Fixed in 3.6.21, 4.0.20 · NVD
  38. High 7.0

    CVE-2021-25329 · Apache Tomcat

    The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for…

    Published 1 Mar 2021 · NVD
  39. High 7.5

    CVE-2021-25122 · Apache Tomcat

    When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

    Published 1 Mar 2021 · NVD
  40. Medium 5.5

    CVE-2020-27618 · GNU C Library

    The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

    Published 26 Feb 2021 · NVD
  41. Medium 5.3

    CVE-2020-27223 · Apache Solr, Eclipse Jetty

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

    Published 26 Feb 2021 · Fixed in 9.4.36 · NVD
  42. High 8.1

    CVE-2021-26701 · .NET

    .NET Core Remote Code Execution Vulnerability

    Published 25 Feb 2021 · Fixed in 5.0.4 · NVD
  43. High 8.1

    CVE-2021-24112 · .NET

    .NET Core Remote Code Execution Vulnerability

    Published 25 Feb 2021 · NVD
  44. Medium 6.5

    CVE-2021-24085 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 25 Feb 2021 · NVD
  45. Medium 5.4

    CVE-2021-1730 · Microsoft Exchange Server

    <p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update addresses this vulnerability.</p> <p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to…

    Published 25 Feb 2021 · NVD
  46. Medium 6.5

    CVE-2021-1721 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 25 Feb 2021 · NVD
  47. High 7.2

    CVE-2021-3273 · Nagios XI

    Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.

    Published 25 Feb 2021 · Fixed in 5.7 · NVD
  48. High 8.2

    CVE-2020-11987 · Oracle WebLogic Server

    Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

    Published 24 Feb 2021 · NVD
  49. High 8.8

    CVE-2021-21974 · VMware ESXi

    OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.

    Published 24 Feb 2021 · NVD
  50. Medium 5.3Actively exploited

    CVE-2021-21973 · VMware vCenter Server

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5…

    Published 24 Feb 2021 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.