UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. Critical 9.8

    CVE-2020-29015 · Fortinet FortiWeb

    A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

    Published 14 Jan 2021 · Fixed in 6.2.4 · NVD
  2. Medium 5.9

    CVE-2021-24122 · Apache Tomcat

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the…

    Published 14 Jan 2021 · NVD
  3. High 7.5

    CVE-2021-3138 · Discourse

    In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.

    Published 14 Jan 2021 · NVD
  4. High 8.1

    CVE-2021-21013 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.

    Published 13 Jan 2021 · NVD
  5. Medium 5.3

    CVE-2021-21012 · Magento / Adobe Commerce

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.

    Published 13 Jan 2021 · NVD
  6. High 7.2

    CVE-2020-35578 · Nagios XI

    An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.

    Published 13 Jan 2021 · Fixed in 5.8.0 · NVD
  7. Medium 4.4

    CVE-2021-3032 · Palo Alto Networks PAN-OS

    An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in…

    Published 13 Jan 2021 · Fixed in 9.0.12, 9.1.4, 10.0.1 · NVD
  8. Medium 4.3

    CVE-2021-3031 · Palo Alto Networks PAN-OS

    Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect…

    Published 13 Jan 2021 · Fixed in 8.1.18, 9.0.12, 9.1.5 · NVD
  9. Medium 5.4

    CVE-2021-21611 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

    Published 13 Jan 2021 · NVD
  10. Medium 6.1

    CVE-2021-21610 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

    Published 13 Jan 2021 · NVD
  11. Medium 5.3

    CVE-2021-21609 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

    Published 13 Jan 2021 · NVD
  12. Medium 5.4

    CVE-2021-21608 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.

    Published 13 Jan 2021 · NVD
  13. Medium 6.5

    CVE-2021-21607 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.

    Published 13 Jan 2021 · NVD
  14. Medium 4.3

    CVE-2021-21606 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.

    Published 13 Jan 2021 · NVD
  15. High 8.0

    CVE-2021-21605 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.

    Published 13 Jan 2021 · NVD
  16. High 8.0

    CVE-2021-21604 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.

    Published 13 Jan 2021 · NVD
  17. Medium 5.4

    CVE-2021-21603 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.

    Published 13 Jan 2021 · NVD
  18. Medium 6.5

    CVE-2021-21602 · Jenkins

    Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.

    Published 13 Jan 2021 · NVD
  19. Medium 6.1

    CVE-2021-23125 · Joomla!

    An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.

    Published 12 Jan 2021 · NVD
  20. Medium 6.1

    CVE-2021-23124 · Joomla!

    An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.

    Published 12 Jan 2021 · NVD
  21. Medium 5.3

    CVE-2021-23123 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules.

    Published 12 Jan 2021 · NVD
  22. High 7.5

    CVE-2021-1723 · .NET

    ASP.NET Core and Visual Studio Denial of Service Vulnerability

    Published 12 Jan 2021 · NVD
  23. High 7.8

    CVE-2021-23240 · sudo

    selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.

    Published 12 Jan 2021 · Fixed in 1.8.32, 1.9.5 · NVD
  24. Low 2.5

    CVE-2021-23239 · sudo

    The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

    Published 12 Jan 2021 · Fixed in 1.8.32, 1.9.5 · NVD
  25. High 7.5

    CVE-2020-17509 · Apache Traffic Server

    ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

    Published 11 Jan 2021 · NVD
  26. High 7.5

    CVE-2020-17508 · Apache Traffic Server

    The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

    Published 11 Jan 2021 · NVD
  27. Medium 5.3

    CVE-2020-28208 · Rocket.Chat

    An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.

    Published 8 Jan 2021 · NVD
  28. Medium 4.8

    CVE-2021-3111 · Concrete CMS

    The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

    Published 8 Jan 2021 · Fixed in 8.5.5 · NVD
  29. Medium 6.1

    CVE-2020-25476 · Liferay Portal / DXP

    Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate…

    Published 7 Jan 2021 · NVD
  30. Medium 6.5

    CVE-2020-8287 · Node.js

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

    Published 6 Jan 2021 · Fixed in 12.20.1, 14.15.4, 15.5.1 · NVD
  31. High 8.1

    CVE-2020-8265 · Node.js

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult…

    Published 6 Jan 2021 · Fixed in 12.20.1, 14.15.4, 15.5.1 · NVD
  32. Critical 9.8

    CVE-2021-3021 · ISPConfig

    ISPConfig before 3.2.2 allows SQL injection.

    Published 5 Jan 2021 · Fixed in 3.2.2 · NVD
  33. Medium 6.1

    CVE-2021-3014 · MikroTik RouterOS

    In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.

    Published 4 Jan 2021 · NVD
  34. Medium 5.9

    CVE-2019-25013 · GNU C Library

    The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

    Published 4 Jan 2021 · NVD
  35. High 7.5

    CVE-2020-25275 · Dovecot

    Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.

    Published 4 Jan 2021 · Fixed in 2.3.13 · NVD
  36. Medium 6.8

    CVE-2020-24386 · Dovecot

    An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).

    Published 4 Jan 2021 · Fixed in 2.3.13 · NVD
  37. High 7.5

    CVE-2020-35965 · FFmpeg

    decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.

    Published 4 Jan 2021 · Fixed in 4.4 · NVD
  38. Medium 6.5

    CVE-2020-35964 · FFmpeg

    track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.

    Published 3 Jan 2021 · NVD
  39. Medium 5.4

    CVE-2020-25799 · LimeSurvey

    LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.

    Published 31 Dec 2020 · NVD
  40. Medium 5.4

    CVE-2020-25797 · LimeSurvey

    LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.

    Published 31 Dec 2020 · NVD
  41. Medium 5.3

    CVE-2020-27534 · Docker Engine

    util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.

    Published 30 Dec 2020 · Fixed in 19.03.9 · NVD
  42. Medium 6.5

    CVE-2020-26288 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

    Published 30 Dec 2020 · Fixed in 4.5.0 · NVD
  43. Medium 6.5

    CVE-2020-5811 · Umbraco CMS

    An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.

    Published 30 Dec 2020 · NVD
  44. Medium 5.4

    CVE-2020-5810 · Umbraco CMS

    A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload.

    Published 30 Dec 2020 · NVD
  45. Medium 5.4

    CVE-2020-5809 · Umbraco CMS

    A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.

    Published 30 Dec 2020 · NVD
  46. Critical 9.8

    CVE-2020-29594 · Rocket.Chat

    Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.

    Published 30 Dec 2020 · Fixed in 3.7.3, 3.8.3, 3.9.1 · NVD
  47. Medium 4.8

    CVE-2020-29471 · OpenCart

    OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.

    Published 29 Dec 2020 · NVD
  48. Medium 4.8

    CVE-2020-29470 · OpenCart

    OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.

    Published 29 Dec 2020 · NVD
  49. Critical 9.8

    CVE-2020-35769 · Webmin

    miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.

    Published 29 Dec 2020 · NVD
  50. Medium 6.1Actively exploited

    CVE-2020-35730 · Roundcube

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

    Published 28 Dec 2020 · Fixed in 1.2.13, 1.3.16, 1.4.10 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.