Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,757
- Published in 7 days
- 963
- Critical in 30 days
- 354
- Actively exploited
- 423
Latest vulnerabilities
39,757 vulnerabilities- Medium 6.1
CVE-2020-35474 · MediaWiki
In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML.
Published 18 Dec 2020 · Fixed in 1.35.1 · NVD - Medium 5.3
CVE-2020-35453 · HashiCorp Vault
HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.
Published 17 Dec 2020 · Fixed in 1.5.6, 1.6.1 · NVD - Medium 5.3
CVE-2020-35177 · HashiCorp Vault
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
Published 17 Dec 2020 · Fixed in 1.5.6, 1.6.1 · NVD - Medium 6.5
CVE-2020-35123 · Zimbra Collaboration
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.
Published 17 Dec 2020 · Fixed in 8.8.15 · NVD - Critical 9.8
CVE-2020-35192 · HashiCorp Vault
The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
Published 17 Dec 2020 · Fixed in 0.11.6 · NVD - Medium 6.5
CVE-2020-29436 · Sonatype Nexus Repository
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.
Published 17 Dec 2020 · Fixed in 3.29.0 · NVD - Unrated
WPV-a26423547b6b · Contact Form 7
Vulnerability in Contact Form 7
Published 17 Dec 2020 · Fixed in 5.3.2 · WPVulnerability - Critical 10.0
CVE-2020-35489 · Contact Form 7
Contact Form 7: Unrestricted Upload of File with Dangerous Type
Published 17 Dec 2020 · Fixed in 5.3.2 · NVD, WPVulnerability - Medium 6.8
CVE-2020-26259 · Apache Struts
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on…
Published 16 Dec 2020 · Fixed in 6.0.0 · NVD - High 7.7
CVE-2020-26258 · Apache Struts
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of…
Published 16 Dec 2020 · Fixed in 6.0.0 · NVD - Medium 6.0
CVE-2020-29486 · Xen
An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has quota implications. Any guest can run another guest out of quota, or create an unbounded number of nodes owned by dom0, thus running xenstored out of memory A malicious guest administrator can cause a denial of service against a specific…
Published 15 Dec 2020 · NVD - Medium 5.5
CVE-2020-29485 · Xen
An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable.
Published 15 Dec 2020 · NVD - Medium 6.0
CVE-2020-29484 · Xen
An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch, and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages, consisting of a message header and the…
Published 15 Dec 2020 · NVD - Medium 6.5
CVE-2020-29483 · Xen
An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately, this is done by just removing the guest from xenstored's internal management, resulting in the same actions as if the guest had been destroyed, including sending an…
Published 15 Dec 2020 · NVD - Medium 6.0
CVE-2020-29482 · Xen
An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily using absolute paths. oxenstored imposes a pathname limit that is applied solely to the relative or…
Published 15 Dec 2020 · NVD - High 8.8
CVE-2020-29481 · Xen
An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed when a domain is being destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes from the previous domain(s) with the same domid. Because all Xenstore entries of a guest below…
Published 15 Dec 2020 · NVD - Low 2.3
CVE-2020-29480 · Xen
An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest administrator can also use the special watches, which will cause a notification every time a domain is created…
Published 15 Dec 2020 · NVD - High 8.8
CVE-2020-29479 · Xen
An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root node, because this node has no parent. Unfortunately, permissions were not checked for certain operations on the root node. Unprivileged guests can get and modify permissions, list, and delete the root node. (Deleting the whole xenstore tree…
Published 15 Dec 2020 · NVD - Medium 6.2
CVE-2020-29571 · Xen
An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes, the consumer side isn't protected against re-ordered reads, and may hence end up de-referencing a NULL pointer. Malicious or buggy guest kernels can mount a…
Published 15 Dec 2020 · NVD - Medium 6.2
CVE-2020-29570 · Xen
An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system.
Published 15 Dec 2020 · NVD - High 8.8
CVE-2020-29569 · Xen
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was…
Published 15 Dec 2020 · NVD - Medium 6.5
CVE-2020-29568 · Xen
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.
Published 15 Dec 2020 · NVD - Medium 6.2
CVE-2020-29567 · Xen
An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-allocated on the relevant CPUs. De-allocation has to happen when certain constraints are met. If these conditions are not met when first checked, the checking CPU may send an interrupt to itself, in the expectation that this IRQ will be…
Published 15 Dec 2020 · NVD - Medium 5.5
CVE-2020-29566 · Xen
An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation, via an event channel, so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation, the de-schedule /…
Published 15 Dec 2020 · NVD - Low
GHSA-cq6h-w3mc-57f4 · Shopware
Information exposure via query strings in URL
Published 15 Dec 2020 · Fixed in 6.3.4.1 · Project advisories (GitHub) - Low
GHSA-8pfh-mm2g-hmc3 · Shopware
Authenticated Server Side Request Forgery
Published 15 Dec 2020 · Fixed in 6.3.4.1 · Project advisories (GitHub) - Low
GHSA-5q58-x5h2-v5rx · Shopware
Authenticated Privilege Escalation
Published 15 Dec 2020 · Fixed in 6.3.4.1 · Project advisories (GitHub) - High 7.5
CVE-2020-35471 · Envoy
Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500.
Published 15 Dec 2020 · Fixed in 1.16.1 · NVD - High 8.8
CVE-2020-35470 · Envoy
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).
Published 15 Dec 2020 · Fixed in 1.16.1 · NVD - High 7.5
CVE-2020-8286 · curl
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Published 14 Dec 2020 · Fixed in 7.74.0 · NVD - High 7.5
CVE-2020-8285 · curl
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Published 14 Dec 2020 · Fixed in 7.74.0 · NVD - Low 3.7
CVE-2020-8284 · curl
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Published 14 Dec 2020 · NVD - High 7.5
CVE-2020-8231 · curl
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
Published 14 Dec 2020 · NVD - High 7.8
CVE-2020-8177 · curl
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
Published 14 Dec 2020 · NVD - High 7.5
CVE-2020-8169 · curl
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
Published 14 Dec 2020 · NVD - Medium 5.3
CVE-2020-17513 · Apache Airflow
In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.
Published 14 Dec 2020 · Fixed in 1.10.13 · NVD - Medium 6.5
CVE-2020-17511 · Apache Airflow
In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.
Published 14 Dec 2020 · Fixed in 1.10.13 · NVD - Medium 5.3
CVE-2020-35175 · Frappe Framework
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.
Published 11 Dec 2020 · NVD - High 7.5
CVE-2020-5949 · F5 BIG-IP
On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break.
Published 11 Dec 2020 · Fixed in 13.1.3.5, 14.1.0 · NVD - Critical 9.6
CVE-2020-5948 · F5 BIG-IP
On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
Published 11 Dec 2020 · Fixed in 13.1.3.5, 14.1.2.8, 15.1.1 · NVD - High 7.5
CVE-2020-27508 · Frappe Framework
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security.
Published 11 Dec 2020 · Fixed in 12.10.0 · NVD - Low 3.5
CVE-2020-28838 · OpenCart
Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.
Published 11 Dec 2020 · NVD - Medium 6.1
CVE-2020-17515 · Apache Airflow
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Published 11 Dec 2020 · Fixed in 1.10.15, 2.0.2 · NVD - Medium 4.3
CVE-2020-26411 · GitLab
A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.3
CVE-2020-26417 · GitLab
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.4
CVE-2020-26416 · GitLab
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 4.3
CVE-2020-26415 · GitLab
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD - Medium 5.3
CVE-2020-26413 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.
Published 11 Dec 2020 · Fixed in 13.6.2 · NVD - Medium 4.3
CVE-2020-26412 · GitLab
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.
Published 11 Dec 2020 · Fixed in 13.6.2 · NVD - Medium 5.3
CVE-2020-26408 · GitLab
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker to view limited information in user's private profile
Published 11 Dec 2020 · Fixed in 13.4.7, 13.5.5, 13.6.2 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.