UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. Low 3.3

    CVE-2020-27774 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick…

    Published 4 Dec 2020 · Fixed in 6.9.10-69, 7.0.9-0 · NVD
  2. Low 3.3

    CVE-2020-27771 · ImageMagick

    In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex() to ssize_t type to avoid this bug. This undefined behavior could be triggered when ImageMagick processes a crafted pdf file. Red Hat Product Security marked this as…

    Published 4 Dec 2020 · Fixed in 6.9.10-69, 7.0.9 · NVD
  3. Medium 5.5

    CVE-2020-27770 · ImageMagick

    Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.

    Published 4 Dec 2020 · Fixed in 6.9.10-68, 7.0.8-68 · NVD
  4. Low 3.3

    CVE-2020-27767 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of types `float` and `unsigned char`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw…

    Published 4 Dec 2020 · Fixed in 6.9.10-69, 7.0.9.0 · NVD
  5. High 7.8

    CVE-2020-27766 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects…

    Published 4 Dec 2020 · Fixed in 6.9.10-69, 7.0.8-69 · NVD
  6. Low 3.3

    CVE-2020-27765 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.

    Published 4 Dec 2020 · Fixed in 6.9.10-69, 7.0.9 · NVD
  7. Medium 4.8

    CVE-2020-29562 · GNU C Library

    The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

    Published 4 Dec 2020 · NVD
  8. Medium 6.5

    CVE-2018-21270 · Node.js

    Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

    Published 3 Dec 2020 · Fixed in 0.0.6 · NVD
  9. High 7.5

    CVE-2020-17527 · Apache Tomcat

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that…

    Published 3 Dec 2020 · NVD
  10. Low 3.3

    CVE-2020-27764 · ImageMagick

    In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range values under some circumstances when a crafted input file is processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific…

    Published 3 Dec 2020 · Fixed in 6.9.10-69 · NVD
  11. Low 3.3

    CVE-2020-27763 · ImageMagick

    A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.

    Published 3 Dec 2020 · Fixed in 6.9.10-68, 7.0.8-68 · NVD
  12. Medium 5.5

    CVE-2020-27762 · ImageMagick

    A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick…

    Published 3 Dec 2020 · Fixed in 6.9.10-68, 7.0.8-68 · NVD
  13. Low 3.3

    CVE-2020-27761 · ImageMagick

    WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead…

    Published 3 Dec 2020 · Fixed in 6.9.10-69, 7.0.9-0 · NVD
  14. Medium 5.5

    CVE-2020-27760 · ImageMagick

    In `GammaImage()` of /MagickCore/enhance.c, depending on the `gamma` value, it's possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick. This could lead to an impact to application availability. The patch uses the `PerceptibleReciprocal()` to prevent the divide-by-zero from occurring. This flaw affects ImageMagick versions prior to ImageMagick…

    Published 3 Dec 2020 · Fixed in 6.9.10-68, 7.0.8-68 · NVD
  15. Low 3.3

    CVE-2020-27759 · ImageMagick

    In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type `int` to be returned. The flaw could be triggered by a crafted input file under certain conditions when processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an…

    Published 3 Dec 2020 · Fixed in 6.9.10-68, 7.0.8-68 · NVD
  16. Medium 4.3

    CVE-2020-14318 · Samba

    A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

    Published 3 Dec 2020 · Fixed in 4.11.15, 4.12.9, 4.13.1 · NVD
  17. Medium 5.9

    CVE-2020-26253 · Kirby

    External Initialization of the Panel on .dev domains and some reverse proxy setups

    Published 2 Dec 2020 · Fixed in 3.3.6 · NVD, Project advisories (GitHub)
  18. Critical 9.1

    CVE-2020-26255 · Kirby

    Remote code execution (RCE) from PHP Phar archives uploaded by Panel users as content files

    Published 2 Dec 2020 · Fixed in 3.4.5 · NVD, Project advisories (GitHub)
  19. Medium 5.3

    CVE-2020-13956 · Oracle WebLogic Server

    Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

    Published 2 Dec 2020 · NVD
  20. Medium 4.3

    CVE-2020-29454 · Umbraco CMS

    Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.

    Published 2 Dec 2020 · NVD
  21. Medium 6.1

    CVE-2020-27816 · Kibana

    The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects…

    Published 2 Dec 2020 · NVD
  22. Medium 6.5

    CVE-2020-14383 · Samba

    A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services…

    Published 2 Dec 2020 · Fixed in 4.11.15, 4.12.9, 4.13.1 · NVD
  23. Medium 5.2

    CVE-2020-15257 · containerd

    containerd-shim API exposed to host network containers

    Published 30 Nov 2020 · Fixed in 1.3.9, 1.4.3 · NVD, Project advisories (GitHub)
  24. Medium 6.5

    CVE-2020-26246 · Pimcore

    Permission issues for redirects, website settings and asset meta-data

    Published 30 Nov 2020 · Fixed in 6.8.5 · NVD, Project advisories (GitHub)
  25. Medium 4.8

    CVE-2020-27218 · Apache Kafka, Eclipse Jetty

    In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same…

    Published 28 Nov 2020 · Fixed in 9.4.35 · NVD
  26. High 7.5

    CVE-2020-10772 · Unbound

    An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete…

    Published 27 Nov 2020 · NVD
  27. Medium 6.1

    CVE-2020-29137 · cPanel & WHM

    cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).

    Published 27 Nov 2020 · Fixed in 90.0.17 · NVD
  28. Medium 6.5

    CVE-2020-29136 · cPanel & WHM

    In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).

    Published 27 Nov 2020 · Fixed in 11.86.0.32, 11.90.0.17, 11.92.0.2 · NVD
  29. Medium 4.1

    CVE-2020-29135 · cPanel & WHM

    cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).

    Published 27 Nov 2020 · Fixed in 90.0.17 · NVD
  30. Medium 4.3

    CVE-2020-27663 · GLPI

    In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).

    Published 26 Nov 2020 · Fixed in 9.5.3 · NVD
  31. Medium 4.3

    CVE-2020-27662 · GLPI

    In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).

    Published 26 Nov 2020 · Fixed in 9.5.3 · NVD
  32. Medium 6.5

    CVE-2020-26212 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. Steps to reproduce the behavior: 1. Create a new planning with…

    Published 25 Nov 2020 · Fixed in 9.5.3 · NVD
  33. Medium 6.1

    CVE-2020-36171 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 25 Nov 2020 · Fixed in 3.0.14 · NVD, WPVulnerability
  34. High 8.8

    CVE-2020-29040 · Xen

    An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly gain privileges because of an off-by-one error. NOTE: this issue is caused by an incorrect fix for CVE-2020-27671.

    Published 24 Nov 2020 · NVD
  35. High 7.5

    CVE-2019-20925 · MongoDB

    An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.

    Published 24 Nov 2020 · Fixed in 3.6.15, 4.0.13, 4.2.1 · NVD
  36. Medium 5.4

    CVE-2020-29003 · MediaWiki

    The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll.

    Published 24 Nov 2020 · NVD
  37. Medium 4.8

    CVE-2020-29002 · MediaWiki

    includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator.

    Published 24 Nov 2020 · NVD
  38. Critical 9.8

    CVE-2020-28991 · Gitea

    Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go.

    Published 24 Nov 2020 · Fixed in 1.12.6 · NVD
  39. Critical 9.8

    CVE-2020-28984 · SPIP

    prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.

    Published 23 Nov 2020 · Fixed in 3.2.8 · NVD
  40. High 7.5

    CVE-2020-25696 · PostgreSQL

    A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality…

    Published 23 Nov 2020 · Fixed in 11.10, 12.5, 13.1 · NVD
  41. Medium 6.5

    CVE-2018-20803 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.

    Published 23 Nov 2020 · Fixed in 3.4.19, 3.6.10, 4.0.5 · NVD
  42. Medium 6.5

    CVE-2020-7928 · MongoDB

    A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20.

    Published 23 Nov 2020 · Fixed in 4.2.9, 4.4.1, 4.5.1 · NVD
  43. Medium 6.5

    CVE-2019-2393 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13 and MongoDB Server v3.6 versions prior to 3.6.15.

    Published 23 Nov 2020 · Fixed in 3.6.15, 4.0.13, 4.2.1 · NVD
  44. Medium 6.5

    CVE-2019-2392 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20.

    Published 23 Nov 2020 · Fixed in 4.0.20, 4.2.9, 4.4.1 · NVD
  45. Medium 6.5

    CVE-2019-20924 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2.

    Published 23 Nov 2020 · Fixed in 4.2.2 · NVD
  46. Medium 6.5

    CVE-2019-20923 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.

    Published 23 Nov 2020 · Fixed in 4.0.7 · NVD
  47. Medium 6.5

    CVE-2018-20805 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.

    Published 23 Nov 2020 · Fixed in 3.6.10, 4.0.5 · NVD
  48. Medium 6.5

    CVE-2018-20804 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.

    Published 23 Nov 2020 · Fixed in 3.6.13, 4.0.10 · NVD
  49. Medium 6.5

    CVE-2018-20802 · MongoDB

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.

    Published 23 Nov 2020 · Fixed in 3.6.9, 4.0.3 · NVD
  50. Medium 6.5

    CVE-2020-7926 · MongoDB

    A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects MongoDB Server v4.4 versions prior to 4.4.1. Versions before 4.4 are not affected.

    Published 23 Nov 2020 · Fixed in 4.4.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.