UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Medium 6.5

    CVE-2020-13280 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  2. Critical 9.8

    CVE-2020-4589 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 184585.

    Published 13 Aug 2020 · NVD
  3. Medium 5.5

    CVE-2020-17538 · Ghostscript

    A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  4. Medium 5.5

    CVE-2020-16310 · Ghostscript

    A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  5. Medium 5.5

    CVE-2020-16309 · Ghostscript

    A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted eps file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  6. Medium 5.5

    CVE-2020-16308 · Ghostscript

    A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  7. Medium 5.5

    CVE-2020-16307 · Ghostscript

    A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  8. Medium 5.5

    CVE-2020-16306 · Ghostscript

    A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  9. Medium 5.5

    CVE-2020-16305 · Ghostscript

    A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  10. Medium 5.5

    CVE-2020-16304 · Ghostscript

    A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to escalate privileges via a crafted eps file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  11. High 7.8

    CVE-2020-16303 · Ghostscript

    A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  12. Medium 5.5

    CVE-2020-16302 · Ghostscript

    A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · NVD
  13. Medium 5.5

    CVE-2020-16301 · Ghostscript

    A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  14. Medium 5.5

    CVE-2020-16300 · Ghostscript

    A buffer overflow vulnerability in tiff12_print_page() in devices/gdevtfnx.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  15. Medium 5.5

    CVE-2020-16299 · Ghostscript

    A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  16. Medium 5.5

    CVE-2020-16298 · Ghostscript

    A buffer overflow vulnerability in mj_color_correct() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  17. Medium 5.5

    CVE-2020-16297 · Ghostscript

    A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  18. Medium 5.5

    CVE-2020-16296 · Ghostscript

    A buffer overflow vulnerability in GetNumWrongData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  19. Medium 5.5

    CVE-2020-16295 · Ghostscript

    A null pointer dereference vulnerability in clj_media_size() in devices/gdevclj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  20. Medium 5.5

    CVE-2020-16294 · Ghostscript

    A buffer overflow vulnerability in epsc_print_page() in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  21. Medium 5.5

    CVE-2020-16293 · Ghostscript

    A null pointer dereference vulnerability in compose_group_nonknockout_nonblend_isolated_allmask_common() in base/gxblend.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  22. Medium 5.5

    CVE-2020-16292 · Ghostscript

    A buffer overflow vulnerability in mj_raster_cmd() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  23. Medium 5.5

    CVE-2020-16291 · Ghostscript

    A buffer overflow vulnerability in contrib/gdevdj9.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  24. Medium 5.5

    CVE-2020-16290 · Ghostscript

    A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  25. Medium 5.5

    CVE-2020-16289 · Ghostscript

    A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  26. Medium 5.5

    CVE-2020-16288 · Ghostscript

    A buffer overflow vulnerability in pj_common_print_page() in devices/gdevpjet.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  27. Medium 5.5

    CVE-2020-16287 · Ghostscript

    A buffer overflow vulnerability in lprn_is_black() in contrib/lips4/gdevlprn.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

    Published 13 Aug 2020 · Fixed in 9.52 · NVD
  28. High 7.5

    CVE-2020-15868 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.

    Published 12 Aug 2020 · Fixed in 3.26.0 · NVD
  29. Low 3.0

    CVE-2020-2035 · Palo Alto Networks PAN-OS

    When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication (SNI) field within the TLS Client Hello handshake. This allows a compromised host in a protected network to evade any…

    Published 12 Aug 2020 · NVD
  30. High 7.5

    CVE-2020-12674 · Dovecot

    In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.

    Published 12 Aug 2020 · Fixed in 2.3.11.3 · NVD
  31. High 7.5

    CVE-2020-12673 · Dovecot

    In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.

    Published 12 Aug 2020 · Fixed in 2.3.11.3 · NVD
  32. High 7.5

    CVE-2020-12100 · Dovecot

    In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.

    Published 12 Aug 2020 · Fixed in 2.3.11.3 · NVD
  33. High 8.1

    CVE-2020-13291 · GitLab

    In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.

    Published 12 Aug 2020 · Fixed in 13.2.3 · NVD
  34. High 7.2

    CVE-2020-13290 · GitLab

    In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page

    Published 12 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  35. Medium 4.8

    CVE-2020-13288 · GitLab

    In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page

    Published 12 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  36. Medium 5.4

    CVE-2020-2231 · Jenkins

    Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.

    Published 12 Aug 2020 · NVD
  37. Medium 5.4

    CVE-2020-2230 · Jenkins

    Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.

    Published 12 Aug 2020 · NVD
  38. Medium 5.4

    CVE-2020-2229 · Jenkins

    Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.

    Published 12 Aug 2020 · NVD
  39. Critical 9.8Actively exploited

    CVE-2020-17496 · vBulletin

    vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

    Published 12 Aug 2020 · NVD
  40. Medium 6.1

    CVE-2020-16145 · Roundcube

    Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.

    Published 12 Aug 2020 · Fixed in 1.3.15, 1.4.8 · NVD
  41. Medium 5.4

    CVE-2020-13294 · GitLab

    In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.

    Published 10 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  42. High 7.1

    CVE-2020-13293 · GitLab

    In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.

    Published 10 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  43. Critical 9.6

    CVE-2020-13292 · GitLab

    In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.

    Published 10 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  44. Medium 6.1

    CVE-2020-15139 · MyBB

    MyCode message formatting XSS in visual editor

    Published 9 Aug 2020 · Fixed in 1.8.24 · NVD, Project advisories (GitHub)
  45. Medium 6.1

    CVE-2020-15831 · TeamCity

    JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

    Published 8 Aug 2020 · Fixed in 2019.2.3 · NVD
  46. Medium 6.1

    CVE-2020-15830 · TeamCity

    JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.

    Published 8 Aug 2020 · Fixed in 2019.2.3 · NVD
  47. Medium 5.3

    CVE-2020-15829 · TeamCity

    In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.

    Published 8 Aug 2020 · Fixed in 2019.2.3 · NVD
  48. Medium 6.5

    CVE-2020-15828 · TeamCity

    In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions.

    Published 8 Aug 2020 · Fixed in 2020.1.1 · NVD
  49. Medium 4.3

    CVE-2020-15826 · TeamCity

    In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.

    Published 8 Aug 2020 · Fixed in 2020.1 · NVD
  50. High 8.8

    CVE-2020-15825 · TeamCity

    In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.

    Published 8 Aug 2020 · Fixed in 2020.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.