Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,757
- Published in 7 days
- 963
- Critical in 30 days
- 354
- Actively exploited
- 423
Latest vulnerabilities
39,757 vulnerabilities- High 8.1
CVE-2020-8259 · Nextcloud
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.
Published 16 Nov 2020 · Fixed in 20.0.0 · NVD - Medium 4.4
CVE-2020-8152 · Nextcloud
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.
Published 16 Nov 2020 · Fixed in 20.0.0 · NVD - High 8.8
CVE-2020-25695 · PostgreSQL
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Published 16 Nov 2020 · Fixed in 11.10, 12.5, 13.1 · NVD - High 8.1
CVE-2020-25694 · PostgreSQL
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist.…
Published 16 Nov 2020 · Fixed in 11.10, 12.5, 13.1 · NVD - High 7.8
CVE-2020-5796 · Nagios XI
Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users being able to write to and execute arbitrary PHP code with root privileges.
Published 13 Nov 2020 · NVD - High 8.2
CVE-2020-2050 · Palo Alto Networks PAN-OS
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on…
Published 12 Nov 2020 · Fixed in 9.0.11, 9.1.5, 10.0.1 · NVD - Low 3.3
CVE-2020-2048 · Palo Alto Networks PAN-OS
An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2.
Published 12 Nov 2020 · Fixed in 8.1.17, 9.0.11, 9.1.2 · NVD - High 7.5
CVE-2020-2022 · Palo Alto Networks PAN-OS
An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of…
Published 12 Nov 2020 · Fixed in 8.1.17, 9.0.11, 9.1.5 · NVD - High 7.2
CVE-2020-2000 · Palo Alto Networks PAN-OS
An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than…
Published 12 Nov 2020 · Fixed in 9.0.10, 9.1.4, 10.0.1 · NVD - Medium 5.3
CVE-2020-1999 · Palo Alto Networks PAN-OS
A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions…
Published 12 Nov 2020 · Fixed in 8.1.17, 9.0.11, 9.1.5 · NVD - Medium 6.2
CVE-2020-17085 · Microsoft Exchange Server
Microsoft Exchange Server Denial of Service Vulnerability
Published 11 Nov 2020 · NVD - High 8.5
CVE-2020-17084 · Microsoft Exchange Server
Microsoft Exchange Server Remote Code Execution Vulnerability
Published 11 Nov 2020 · NVD - Medium 5.5
CVE-2020-17083 · Microsoft Exchange Server
Microsoft Exchange Server Remote Code Execution Vulnerability
Published 11 Nov 2020 · NVD - Medium 6.6
CVE-2020-17049 · Samba
A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this…
Published 11 Nov 2020 · Fixed in 4.13.13, 4.14.9, 4.15.1 · NVD - Medium 4.4
CVE-2020-28368 · Xen
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
Published 10 Nov 2020 · NVD - Critical 9.8Actively exploited
CVE-2020-13927 · Apache Airflow
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but…
Published 10 Nov 2020 · Fixed in 1.10.11 · NVD - Medium 4.1
CVE-2020-8150 · Nextcloud
A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.
Published 9 Nov 2020 · Fixed in 19.0.2 · NVD - Medium 5.3
CVE-2020-8133 · Nextcloud
A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file.
Published 9 Nov 2020 · NVD - Critical 9.1
CVE-2020-24407 · Magento / Adobe Commerce
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.
Published 9 Nov 2020 · Fixed in 2.3.5 · NVD - Low 3.7
CVE-2020-24406 · Magento / Adobe Commerce
When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.
Published 9 Nov 2020 · NVD - Medium 4.3
CVE-2020-24405 · Magento / Adobe Commerce
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.
Published 9 Nov 2020 · Fixed in 2.3.5 · NVD - Low 2.7
CVE-2020-24404 · Magento / Adobe Commerce
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.
Published 9 Nov 2020 · Fixed in 2.3.5 · NVD - Low 2.7
CVE-2020-24403 · Magento / Adobe Commerce
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.
Published 9 Nov 2020 · Fixed in 2.3.5 · NVD - Medium 4.9
CVE-2020-24402 · Magento / Adobe Commerce
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.
Published 9 Nov 2020 · Fixed in 2.3.5 · NVD - Medium 6.5
CVE-2020-24401 · Magento / Adobe Commerce
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.
Published 9 Nov 2020 · Fixed in 2.3.5 · NVD - High 7.1
CVE-2020-24400 · Magento / Adobe Commerce
Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.
Published 9 Nov 2020 · Fixed in 2.3.5 · NVD - High 7.5
CVE-2020-28196 · MySQL
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
Published 6 Nov 2020 · NVD - Unrated
WPV-2f6dda7b6eb2 · WooCommerce
Vulnerability in WooCommerce
Published 6 Nov 2020 · Fixed in 4.6.2 · WPVulnerability - High 8.4
CVE-2020-5945 · F5 BIG-IP
In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin.
Published 5 Nov 2020 · Fixed in 14.1.2.8, 15.1.1, 16.0.1 · NVD - Medium 6.5
CVE-2020-5943 · F5 BIG-IP
In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password.
Published 5 Nov 2020 · NVD - High 7.5
CVE-2020-5941 · F5 BIG-IP
On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel (TMM) to generate a core file and restart. This issue occurs when data exceeding the maximum limit of a hostname passes to the RESOLV::lookup command.
Published 5 Nov 2020 · Fixed in 15.1.1, 16.0.1 · NVD - Medium 5.4
CVE-2020-5940 · F5 BIG-IP
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
Published 5 Nov 2020 · Fixed in 14.1.2.4, 15.1.1, 16.0.1 · NVD - High 7.5
CVE-2020-5939 · F5 BIG-IP
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic.
Published 5 Nov 2020 · Fixed in 14.1.2.7, 15.1.0.4, 16.0.1 · NVD - Unrated
WPV-ef33e4c48593 · WooCommerce
Vulnerability in WooCommerce
Published 5 Nov 2020 · Fixed in 4.6.2 · WPVulnerability - High 8.8
CVE-2020-22278 · phpMyAdmin
phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.
Published 4 Nov 2020 · NVD - Medium 6.8
CVE-2020-8236 · Nextcloud
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.
Published 2 Nov 2020 · Fixed in 19.0.2 · NVD - High 7.5
CVE-2020-8183 · Nextcloud
A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.
Published 2 Nov 2020 · Fixed in 18.0.6, 19.0.1 · NVD - Low 2.2
CVE-2020-8173 · Nextcloud
A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.
Published 2 Nov 2020 · Fixed in 17.0.7, 18.0.5 · NVD - Medium 4.3
CVE-2020-28040 · WordPress
WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Critical 9.1
CVE-2020-28039 · WordPress
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Medium 6.1
CVE-2020-28038 · WordPress
WordPress before 5.5.2 allows stored XSS via post slugs.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Critical 9.8
CVE-2020-28037 · WordPress
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Critical 9.8
CVE-2020-28036 · WordPress
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Critical 9.8
CVE-2020-28035 · WordPress
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Medium 6.1
CVE-2020-28034 · WordPress
WordPress before 5.5.2 allows XSS associated with global variables.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - High 7.5
CVE-2020-28033 · WordPress
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Critical 9.8
CVE-2020-28032 · WordPress
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
Published 2 Nov 2020 · Fixed in 5.5.2 · NVD - Medium 5.3
CVE-2020-28002 · SonarQube Server
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint.
Published 2 Nov 2020 · NVD - Critical 9.8Actively exploited
CVE-2020-14750 · Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in…
Published 2 Nov 2020 · NVD - Critical 9.8
CVE-2020-7373 · vBulletin
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.
Published 30 Oct 2020 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.