UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
962
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Critical 9.8Actively exploited

    CVE-2021-21972 · VMware vCenter Server

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware…

    Published 24 Feb 2021 · NVD
  2. Low 2.5

    CVE-2021-27645 · GNU C Library

    The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

    Published 24 Feb 2021 · NVD
  3. Medium 4.3

    CVE-2021-20229 · PostgreSQL

    A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

    Published 23 Feb 2021 · Fixed in 13.2 · NVD
  4. Low 3.3

    CVE-2020-27768 · ImageMagick

    In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0.

    Published 23 Feb 2021 · Fixed in 7.0.9-0 · NVD
  5. Medium 5.9

    CVE-2021-27568 · Oracle WebLogic Server

    An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.

    Published 23 Feb 2021 · NVD
  6. Medium 5.3

    CVE-2020-29453 · Jira

    The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

    Published 22 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD
  7. Medium 5.3

    CVE-2020-29448 · Confluence

    The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

    Published 22 Feb 2021 · Fixed in 6.13.18, 7.4.6, 7.8.3 · NVD
  8. Medium 5.4

    CVE-2021-27279 · MyBB

    Nested Email MyCode Persistent XSS

    Published 22 Feb 2021 · Fixed in 1.8.25 · NVD, Project advisories (GitHub)
  9. High 7.2

    CVE-2021-21302 · PrestaShop

    CSV Injection via csv export

    Published 22 Feb 2021 · Fixed in 1.7.7.2 · NVD, Project advisories (GitHub)
  10. Critical 9.1

    CVE-2021-21308 · PrestaShop

    Improper session management for soft logout

    Published 22 Feb 2021 · Fixed in 1.7.7.2 · NVD, Project advisories (GitHub)
  11. High 7.5

    CVE-2021-26119 · Smarty

    Sandbox escape through template_object

    Published 21 Feb 2021 · Fixed in 3.1.39 · NVD, Project advisories (GitHub)
  12. Critical 9.8

    CVE-2021-26120 · Smarty

    PHP Code Injection by malicious function name

    Published 21 Feb 2021 · Fixed in 3.1.39 · NVD, Project advisories (GitHub)
  13. High

    GHSA-jw8j-qp56-25m2 · Metabase

    Possible SQL Injection With Redshift and Postgres Match and Replace Operations

    Published 19 Feb 2021 · Fixed in 0.36.11 · Project advisories (GitHub)
  14. High 7.8

    CVE-2021-27379 · Xen

    An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS crash) or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct. NOTE: this issue exists because of an incomplete fix for CVE-2020-15565.

    Published 18 Feb 2021 · Fixed in 4.12.0 · NVD
  15. High 7.5

    CVE-2020-28491 · Oracle WebLogic Server

    This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

    Published 18 Feb 2021 · NVD
  16. High 7.1

    CVE-2021-23340 · Pimcore

    This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename].…

    Published 18 Feb 2021 · Fixed in 6.8.8 · NVD
  17. High 7.5

    CVE-2021-20354 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 194883.

    Published 18 Feb 2021 · NVD
  18. High 8.1

    CVE-2020-8625 · BIND 9

    BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is…

    Published 17 Feb 2021 · NVD
  19. Medium 5.3

    CVE-2021-26697 · Apache Airflow

    The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.

    Published 17 Feb 2021 · NVD
  20. Medium 6.5

    CVE-2021-26559 · Apache Airflow

    Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

    Published 17 Feb 2021 · NVD
  21. Medium 5.5

    CVE-2021-26933 · Xen

    An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed.…

    Published 17 Feb 2021 · NVD
  22. Medium 5.9

    CVE-2021-23841 · OpenSSL, MySQL

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref…

    Published 16 Feb 2021 · Fixed in 1.1.1j, 5.7.33, 8.0.23 · NVD
  23. High 7.5

    CVE-2021-23840 · Node.js, OpenSSL, MySQL

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave…

    Published 16 Feb 2021 · Fixed in 10.24.0, 12.21.0, 15.10.0 · NVD
  24. Low 3.7

    CVE-2021-23839 · OpenSSL

    OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is…

    Published 16 Feb 2021 · NVD
  25. Medium 5.4

    CVE-2021-27231 · Hestia Control Panel

    Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages.

    Published 16 Feb 2021 · NVD
  26. High 8.8

    CVE-2020-24899 · Nagios XI

    Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.

    Published 15 Feb 2021 · NVD
  27. High 7.2

    CVE-2020-22427 · Nagios XI

    NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later…

    Published 15 Feb 2021 · NVD
  28. Medium 6.1

    CVE-2021-25299 · Nagios XI

    Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution…

    Published 15 Feb 2021 · NVD
  29. High 8.8Actively exploited

    CVE-2021-25298 · Nagios XI

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

    Published 15 Feb 2021 · NVD
  30. High 8.8Actively exploited

    CVE-2021-25297 · Nagios XI

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

    Published 15 Feb 2021 · NVD
  31. High 8.8Actively exploited

    CVE-2021-25296 · Nagios XI

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

    Published 15 Feb 2021 · NVD
  32. Medium 5.9

    CVE-2021-23336 · Python

    The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation…

    Published 15 Feb 2021 · Fixed in 3.7.10, 3.8.8, 3.9.2 · NVD
  33. High 7.5

    CVE-2021-21702 · PHP

    In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

    Published 15 Feb 2021 · Fixed in 7.3.27, 7.4.15, 8.0.2 · NVD
  34. Medium 5.3

    CVE-2020-7071 · PHP

    In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.

    Published 15 Feb 2021 · Fixed in 7.3.26, 7.4.14, 8.0.1 · NVD
  35. Medium 4.3

    CVE-2020-29451 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1.

    Published 15 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.14.1 · NVD
  36. Medium 5.3

    CVE-2020-36237 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0.

    Published 15 Feb 2021 · Fixed in 8.15.0 · NVD
  37. Medium 6.1

    CVE-2020-36236 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.

    Published 15 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD
  38. Medium 5.3

    CVE-2020-36235 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1.

    Published 15 Feb 2021 · Fixed in 8.13.2, 8.14.1 · NVD
  39. Medium 4.8

    CVE-2020-36234 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.

    Published 15 Feb 2021 · Fixed in 8.5.11, 8.13.3, 8.15.0 · NVD
  40. Critical 9.8

    CVE-2019-25019 · LimeSurvey

    LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.

    Published 14 Feb 2021 · Fixed in 3.19.0 · NVD
  41. High 8.3

    CVE-2021-22978 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are…

    Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  42. High 7.5

    CVE-2021-22977 · F5 BIG-IP

    On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 12 Feb 2021 · Fixed in 14.1.3.1, 16.0.1.1 · NVD
  43. Medium 4.8

    CVE-2021-22981 · F5 BIG-IP

    On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not…

    Published 12 Feb 2021 · NVD
  44. High 7.8

    CVE-2021-22980 · F5 BIG-IP

    In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on…

    Published 12 Feb 2021 · Fixed in 13.1.3.6, 16.0.1.1 · NVD
  45. Medium 6.1

    CVE-2021-22979 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note:…

    Published 12 Feb 2021 · Fixed in 14.1.2.8, 15.1.1, 16.0.1 · NVD
  46. High 7.5

    CVE-2021-22975 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.2.1, 16.0.1.1 · NVD
  47. High 7.5

    CVE-2021-22974 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for…

    Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.2, 16.0.1.1 · NVD
  48. High 7.5

    CVE-2021-22973 · F5 BIG-IP

    On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

    Published 12 Feb 2021 · Fixed in 14.1.3.1, 15.1.2, 16.0.1.1 · NVD
  49. High 7.2Actively exploited

    CVE-2021-21311 · Adminer

    Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

    Published 11 Feb 2021 · Fixed in 4.7.9 · NVD
  50. Critical 9.1

    CVE-2021-21014 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    Published 11 Feb 2021 · Fixed in 2.3.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.