Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,756
- Published in 7 days
- 962
- Critical in 30 days
- 354
- Actively exploited
- 423
Latest vulnerabilities
39,756 vulnerabilities- Medium 5.6
CVE-2021-21032 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.6
CVE-2021-21031 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - High 8.1
CVE-2021-21030 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 4.8
CVE-2021-21029 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 4.3
CVE-2021-21027 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.3
CVE-2021-21026 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21025 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21024 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 4.8
CVE-2021-21023 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.3
CVE-2021-21022 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Medium 5.3
CVE-2021-21020 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21019 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21018 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - Critical 9.1
CVE-2021-21016 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - High 8.0
CVE-2021-21015 · Magento / Adobe Commerce
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published 11 Feb 2021 · Fixed in 2.3.6 · NVD - High 7.0
CVE-2021-20188 · Podman
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means…
Published 11 Feb 2021 · Fixed in 1.7.0 · NVD - Medium 4.9
CVE-2020-7021 · Elasticsearch
Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.
Published 10 Feb 2021 · Fixed in 6.8.14, 7.10.0 · NVD - High 8.2
CVE-2021-20353 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.
Published 10 Feb 2021 · Fixed in 8.0.0.15, 8.5.5.20, 9.0.5.7 · NVD - Critical 9.6
CVE-2020-35125 · Mautic
A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept).
Published 9 Feb 2021 · Fixed in 2.16.5, 3.2.4 · NVD - Medium 6.1
CVE-2020-35572 · Adminer
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.
Published 9 Feb 2021 · NVD - Medium 6.5
CVE-2021-26921 · Argo CD
In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.
Published 9 Feb 2021 · Fixed in 1.7.12, 1.8.4 · NVD - Medium 5.4
CVE-2021-26925 · Roundcube
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
Published 9 Feb 2021 · Fixed in 1.4.11 · NVD - Medium 6.1
CVE-2020-13947 · Apache ActiveMQ
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
Published 8 Feb 2021 · Fixed in 5.15.14, 5.16.1 · NVD - Medium 6.1
CVE-2021-22122 · Fortinet FortiWeb
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.
Published 8 Feb 2021 · NVD - Low
GHSA-jvg4-9rc2-wvcr · Shopware
Generation of fake documents via public GET-call
Published 8 Feb 2021 · Fixed in 6.3.5.1 · Project advisories (GitHub) - High 7.5
CVE-2021-32711 · Shopware
Leak of information via Store-API
Published 8 Feb 2021 · Fixed in 6.3.5.1 · NVD, Project advisories (GitHub) - Medium 5.5
CVE-2021-20176 · ImageMagick
A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
Published 6 Feb 2021 · Fixed in 6.9.11-57, 7.0.10-56 · NVD - High 7.5
CVE-2021-3382 · Gitea
Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.
Published 5 Feb 2021 · NVD - Critical 9.8
CVE-2021-3311 · October CMS
Session ID not invalidated after logout
Published 5 Feb 2021 · Fixed in 1.0.472 · NVD, Project advisories (GitHub) - High 7.1
CVE-2021-25276 · SolarWinds Serv-U
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the…
Published 3 Feb 2021 · Fixed in 15.2.2 · NVD - Medium 5.4
CVE-2020-8294 · Nextcloud
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
Published 3 Feb 2021 · Fixed in 18.0.11, 19.0.5, 20.0.2 · NVD - Medium 5.3
CVE-2021-25778 · TeamCity
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD - Medium 5.3
CVE-2021-25777 · TeamCity
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD - High 7.5
CVE-2021-25776 · TeamCity
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
Published 3 Feb 2021 · Fixed in 2020.2 · NVD - Low 3.8
CVE-2021-25775 · TeamCity
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD - Medium 4.3
CVE-2021-25774 · TeamCity
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
Published 3 Feb 2021 · Fixed in 2020.2.1 · NVD - Medium 6.1
CVE-2021-25773 · TeamCity
JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
Published 3 Feb 2021 · Fixed in 2020.2 · NVD - Medium 5.3
CVE-2021-25772 · TeamCity
In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
Published 3 Feb 2021 · Fixed in 2020.2.2 · NVD - High 7.5
CVE-2020-35667 · TeamCity
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
Published 3 Feb 2021 · Fixed in 2020.2.85695 · NVD - Medium 5.4
CVE-2020-35482 · SolarWinds Serv-U
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
Published 3 Feb 2021 · Fixed in 15.2.2 · NVD - Critical 9.8
CVE-2020-35481 · SolarWinds Serv-U
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.
Published 3 Feb 2021 · Fixed in 15.2.2 · NVD - Medium 5.4
CVE-2020-28001 · SolarWinds Serv-U
SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
Published 3 Feb 2021 · Fixed in 15.2.2 · NVD - Medium 6.5
CVE-2020-27994 · SolarWinds Serv-U
SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.
Published 3 Feb 2021 · Fixed in 15.2.2 · NVD - Medium 5.3
CVE-2020-29662 · Harbor
In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.
Published 2 Feb 2021 · Fixed in 2.0.5, 2.1.2 · NVD - Medium 5.9
CVE-2021-20199 · Podman
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
Published 2 Feb 2021 · Fixed in 3.0.0 · NVD - High
GHSA-x7p5-p2c9-phvg · Laravel
Unexpected database bindings via requests (follow-up)
Published 2 Feb 2021 · Fixed in 6.20.14 · Project advisories (GitHub) - Medium 6.5
CVE-2021-21285 · Docker Engine
Docker daemon crash during image pull of malicious image
Published 2 Feb 2021 · Fixed in 19.03.15, 20.10.3 · NVD, Project advisories (GitHub) - Medium 6.8
CVE-2021-21284 · Docker Engine
Access to remapped root allows privilege escalation to real root
Published 2 Feb 2021 · Fixed in 19.03.15, 20.10.3 · NVD, Project advisories (GitHub) - Medium 4.3
CVE-2020-36231 · Jira
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.
Published 2 Feb 2021 · Fixed in 8.5.10, 8.13.2 · NVD - High 7.7
CVE-2021-21287 · MinIO
MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this…
Published 1 Feb 2021 · Fixed in 2021-01-30t00-20-58z · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.