UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. High 8.3

    CVE-2020-13321 · GitLab

    A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  2. Medium 6.5

    CVE-2020-13320 · GitLab

    An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  3. Medium 4.3

    CVE-2020-13319 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  4. High 8.8

    CVE-2020-13296 · GitLab

    An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens

    Published 30 Sept 2020 · Fixed in 13.0.14, 13.1.8, 13.2.6 · NVD
  5. Low 3.3

    CVE-2020-4629 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.

    Published 30 Sept 2020 · NVD
  6. Medium 5.3

    CVE-2020-5132 · SonicWall SonicOS

    SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision vulnerability. When the users publicly display their organization’s internal domain names in the SSL-VPN authentication page, an attacker with knowledge of internal domain names can potentially take advantage of this vulnerability.

    Published 30 Sept 2020 · NVD
  7. Medium 4.3

    CVE-2020-13794 · Harbor

    Authenticated users can exploit an enumeration vulnerability in Harbor (CVE-2020-13794)

    Published 28 Sept 2020 · Fixed in 2.0.3 · NVD, Project advisories (GitHub)
  8. High 7.5

    CVE-2020-26121 · MediaWiki

    An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an upload restriction and a create restriction. An attacker cannot leverage this to overwrite anything, but can…

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  9. Medium 6.1

    CVE-2020-26120 · MediaWiki

    XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  10. High 7.5

    CVE-2020-25869 · MediaWiki

    An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  11. Medium 6.1

    CVE-2020-25828 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all…

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  12. High 7.5

    CVE-2020-25827 · MediaWiki

    An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  13. Medium 6.1

    CVE-2020-25815 · MediaWiki

    An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text().

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  14. Medium 6.1

    CVE-2020-25814 · MediaWiki

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object…

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  15. Medium 5.3

    CVE-2020-25813 · MediaWiki

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  16. Medium 6.1

    CVE-2020-25812 · MediaWiki

    An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  17. High 7.2

    CVE-2020-26116 · Python

    http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

    Published 27 Sept 2020 · Fixed in 3.6.12, 3.7.9, 3.8.5 · NVD
  18. High 7.5

    CVE-2020-5930 · F5 BIG-IP

    In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated attackers can cause disruption of service via undisclosed methods.

    Published 25 Sept 2020 · Fixed in 13.1.3.4, 14.1.2.8, 15.1.0.5 · NVD
  19. Medium 5.9

    CVE-2020-5929 · F5 BIG-IP

    In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS…

    Published 25 Sept 2020 · Fixed in 11.6.2, 12.1.2 · NVD
  20. Medium 6.1

    CVE-2020-26115 · cPanel & WHM

    cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).

    Published 25 Sept 2020 · Fixed in 90.0.10 · NVD
  21. Medium 6.1

    CVE-2020-26114 · cPanel & WHM

    cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).

    Published 25 Sept 2020 · Fixed in 90.0.10 · NVD
  22. Medium 6.1

    CVE-2020-26113 · cPanel & WHM

    cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).

    Published 25 Sept 2020 · Fixed in 90.0.10 · NVD
  23. High 7.5

    CVE-2020-26112 · cPanel & WHM

    The email quota cache in cPanel before 90.0.10 allows overwriting of files.

    Published 25 Sept 2020 · Fixed in 90.0.10 · NVD
  24. Medium 6.1

    CVE-2020-26111 · cPanel & WHM

    cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).

    Published 25 Sept 2020 · Fixed in 90.0.10 · NVD
  25. Medium 6.1

    CVE-2020-26110 · cPanel & WHM

    cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).

    Published 25 Sept 2020 · Fixed in 88.0.13 · NVD
  26. High 7.5

    CVE-2020-26109 · cPanel & WHM

    cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  27. Critical 9.8

    CVE-2020-26108 · cPanel & WHM

    cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).

    Published 25 Sept 2020 · Fixed in 88.0.13 · NVD
  28. High 7.5

    CVE-2020-26107 · cPanel & WHM

    cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  29. High 7.5

    CVE-2020-26106 · cPanel & WHM

    cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  30. Critical 9.8

    CVE-2020-26105 · cPanel & WHM

    In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  31. High 7.5

    CVE-2020-26104 · cPanel & WHM

    In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  32. High 7.5

    CVE-2020-26103 · cPanel & WHM

    In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  33. High 7.5

    CVE-2020-26102 · cPanel & WHM

    In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  34. Critical 9.8

    CVE-2020-26101 · cPanel & WHM

    In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  35. Critical 9.8

    CVE-2020-26100 · cPanel & WHM

    chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  36. High 7.5

    CVE-2020-26099 · cPanel & WHM

    cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  37. Critical 9.8

    CVE-2020-26098 · cPanel & WHM

    cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).

    Published 25 Sept 2020 · Fixed in 88.0.3 · NVD
  38. Medium 5.3

    CVE-2020-15840 · Liferay Portal / DXP

    In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

    Published 24 Sept 2020 · Fixed in 7.3.1 · NVD
  39. Medium 5.3

    CVE-2020-12818 · Fortinet FortiOS

    An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed.

    Published 24 Sept 2020 · Fixed in 6.4.1 · NVD
  40. Medium 5.4

    CVE-2020-15162 · PrestaShop

    Stored XSS in upload files

    Published 24 Sept 2020 · Fixed in 1.7.6.8 · NVD, Project advisories (GitHub)
  41. Medium 6.1

    CVE-2020-15161 · PrestaShop

    Potential XSS injection with contact form

    Published 24 Sept 2020 · Fixed in 1.7.6.8 · NVD, Project advisories (GitHub)
  42. Critical 9.8

    CVE-2020-15160 · PrestaShop

    Blind SQLi in Catalog Product edition

    Published 24 Sept 2020 · Fixed in 1.7.6.8 · NVD, Project advisories (GitHub)
  43. Medium 5.3

    CVE-2020-25768 · Contao

    Insert tag injection in forms

    Published 24 Sept 2020 · Fixed in 4.4.52, 4.9.6, 4.10.1 · NVD, Project advisories (GitHub)
  44. Medium 4.7

    CVE-2020-25604 · Xen

    An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same guest (also operating on the timers) to release a lock that it didn't acquire. The most likely effect of the issue is a hang or crash of the hypervisor, i.e., a…

    Published 23 Sept 2020 · NVD
  45. High 7.8

    CVE-2020-25603 · Xen

    An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able…

    Published 23 Sept 2020 · NVD
  46. Medium 6.0

    CVE-2020-25602 · Xen

    An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access. For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed without error handling for a…

    Published 23 Sept 2020 · NVD
  47. Medium 5.5

    CVE-2020-25601 · Xen

    An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these (when resetting all event channels or when cleaning up after the guest) may take extended periods of time. So far, there was no arrangement for…

    Published 23 Sept 2020 · NVD
  48. Medium 5.5

    CVE-2020-25600 · Xen

    An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only 1023 channels, due to limited space in their shared (between guest and Xen)…

    Published 23 Sept 2020 · NVD
  49. High 7.0

    CVE-2020-25599 · Xen

    An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory accesses or triggering of bug checks. In particular, x86 PV guests may be able to elevate their…

    Published 23 Sept 2020 · NVD
  50. Medium 5.5

    CVE-2020-25598 · Xen

    An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU…

    Published 23 Sept 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.