UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
962
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. High 7.5

    CVE-2020-9490 · Apache HTTP Server

    Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

    Published 7 Aug 2020 · Fixed in 2.4.46 · NVD
  2. High 7.5

    CVE-2020-11993 · Apache HTTP Server

    Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

    Published 7 Aug 2020 · Fixed in 2.4.44 · NVD
  3. Medium 5.3

    CVE-2020-11985 · Apache HTTP Server

    IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

    Published 7 Aug 2020 · NVD
  4. Critical 9.8

    CVE-2020-11984 · Apache HTTP Server

    Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

    Published 7 Aug 2020 · NVD
  5. Medium 6.1

    CVE-2020-16192 · LimeSurvey

    LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.

    Published 5 Aug 2020 · NVD
  6. Low

    GHSA-vjg6-93fv-qv64 · etcd

    Inaccurate logging of authentication attempts for users with CN-based auth only

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  7. Low

    GHSA-pm3m-32r3-7mfh · etcd

    Auto compaction retention negative value causing a compaction loop or a crash

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  8. Low

    GHSA-9gp7-6833-wv89 · etcd

    A negative value for cluster node size results in an index out-of-bound panic during service discovery

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  9. Medium

    GHSA-j86v-2vjr-fg8f · etcd

    Gateway TLS endpoint validation only confirms TCP reachability

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  10. Medium

    CVE-2020-15136 · etcd

    Gateway TLS authentication only applies to endpoints detected in DNS SRV records

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  11. High

    CVE-2020-15114 · etcd

    Gateway can include itself as an endpoint resulting in resource exhaustion

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  12. Low

    GHSA-5x4g-q5rc-36jp · etcd

    Insecure ciphers are allowed by default

    Published 5 Aug 2020 · Fixed in 3.4.22 · Project advisories (GitHub)
  13. Medium 6.5

    CVE-2020-15106 · etcd

    A large slice causes panic in decodeRecord method

    Published 5 Aug 2020 · Fixed in 3.3.23, 3.4.10 · NVD, Project advisories (GitHub)
  14. Low

    GHSA-528j-9r78-wffx · etcd

    User credentials are stored in WAL logs in plaintext

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  15. Medium

    CVE-2020-15115 · etcd

    No minimum password length

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  16. Medium 6.5

    CVE-2020-15112 · etcd

    An entry with large index causes panic in WAL ReadAll method

    Published 5 Aug 2020 · Fixed in 3.3.23, 3.4.10 · NVD, Project advisories (GitHub)
  17. High 7.1

    CVE-2020-15113 · etcd

    Directories created via os.MkdirAll are not checked for permissions

    Published 5 Aug 2020 · Fixed in 3.3.23, 3.4.10 · NVD, Project advisories (GitHub)
  18. Low

    GHSA-h8g9-6gvh-5mrc · etcd

    TOCTOU of gateway endpoint authentication

    Published 5 Aug 2020 · Fixed in 3.3.23 · Project advisories (GitHub)
  19. High 8.8

    CVE-2020-4534 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges. IBM X-Force ID: 182808.

    Published 3 Aug 2020 · NVD
  20. High 8.8

    CVE-2020-15871 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.

    Published 31 Jul 2020 · Fixed in 3.25.1 · NVD
  21. Medium 6.1

    CVE-2020-15870 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).

    Published 31 Jul 2020 · Fixed in 3.25.1 · NVD
  22. Medium 5.4

    CVE-2020-15869 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).

    Published 31 Jul 2020 · Fixed in 3.25.1 · NVD
  23. Medium 6.3

    CVE-2020-15128 · October CMS

    Encrypted cookie values are not tied to the cookie name

    Published 30 Jul 2020 · Fixed in 1.0.468 · NVD, Project advisories (GitHub)
  24. Medium 4.7

    CVE-2020-15129 · Traefik

    X-Forwarded-Prefix Header Validation Vulnerability

    Published 30 Jul 2020 · Fixed in 1.7.26, 2.2.8, 2.3.0-rc3 · NVD, Project advisories (GitHub)
  25. Medium 6.8

    CVE-2020-8222 · Ivanti Connect Secure

    A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting.

    Published 30 Jul 2020 · NVD
  26. Medium 4.9

    CVE-2020-8221 · Ivanti Connect Secure

    A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface.

    Published 30 Jul 2020 · NVD
  27. Medium 6.5

    CVE-2020-8220 · Ivanti Connect Secure

    A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS.

    Published 30 Jul 2020 · NVD
  28. High 7.2

    CVE-2020-8219 · Ivanti Connect Secure

    An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.

    Published 30 Jul 2020 · NVD
  29. High 7.2Actively exploited

    CVE-2020-8218 · Ivanti Connect Secure

    A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

    Published 30 Jul 2020 · NVD
  30. Medium 5.4

    CVE-2020-8217 · Ivanti Connect Secure

    A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.

    Published 30 Jul 2020 · NVD
  31. Medium 4.3

    CVE-2020-8216 · Ivanti Connect Secure

    An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID.

    Published 30 Jul 2020 · NVD
  32. High 8.1

    CVE-2020-8206 · Ivanti Connect Secure

    An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP.

    Published 30 Jul 2020 · NVD
  33. Medium 6.1

    CVE-2020-8204 · Ivanti Connect Secure

    A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.

    Published 30 Jul 2020 · NVD
  34. High 8.1

    CVE-2020-15099 · TYPO3

    In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3…

    Published 29 Jul 2020 · Fixed in 9.5.20, 10.4.6 · NVD
  35. High 8.8

    CVE-2020-15098 · TYPO3

    In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential…

    Published 29 Jul 2020 · Fixed in 9.5.20, 10.4.6 · NVD
  36. Medium 5.9

    CVE-2020-8553 · Ingress NGINX Controller

    The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

    Published 29 Jul 2020 · Fixed in 0.28.0 · NVD
  37. Medium 6.5

    CVE-2020-9692 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  38. Critical 9.6

    CVE-2020-9691 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  39. Medium 4.2

    CVE-2020-9690 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  40. Medium 6.5

    CVE-2020-9689 · Magento / Adobe Commerce

    Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jul 2020 · Fixed in 2.3.5 · NVD
  41. High 7.5

    CVE-2020-13997 · Shopware

    In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.

    Published 28 Jul 2020 · Fixed in 6.2.3 · NVD
  42. Medium 5.4

    CVE-2020-13971 · Shopware

    In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.

    Published 28 Jul 2020 · Fixed in 6.2.3 · NVD
  43. High 8.8

    CVE-2020-13970 · Shopware

    Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.

    Published 28 Jul 2020 · Fixed in 6.2.3 · NVD
  44. High 7.2

    CVE-2020-11476 · Concrete CMS

    Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.

    Published 28 Jul 2020 · Fixed in 8.5.3 · NVD
  45. High 7.5

    CVE-2020-15628 · Control Web Panel

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries.…

    Published 28 Jul 2020 · NVD
  46. High 7.5

    CVE-2020-15627 · Control Web Panel

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the account parameter, the process does not properly validate a user-supplied string before using it to construct SQL…

    Published 28 Jul 2020 · NVD
  47. High 7.5

    CVE-2020-15626 · Control Web Panel

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the term parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An…

    Published 28 Jul 2020 · NVD
  48. High 7.5

    CVE-2020-15625 · Control Web Panel

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_add_mailbox.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries.…

    Published 28 Jul 2020 · NVD
  49. High 7.5

    CVE-2020-15624 · Control Web Panel

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_new_account.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries.…

    Published 28 Jul 2020 · NVD
  50. Critical 9.8

    CVE-2020-15623 · Control Web Panel

    This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker…

    Published 28 Jul 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.