UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
954
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. Medium 5.5

    CVE-2020-5908 · F5 BIG-IP

    In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files.

    Published 1 Jul 2020 · NVD
  2. High 7.2

    CVE-2020-5907 · F5 BIG-IP

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality.

    Published 1 Jul 2020 · NVD
  3. High 8.1

    CVE-2020-5906 · F5 BIG-IP

    In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.

    Published 1 Jul 2020 · NVD
  4. Medium 4.3

    CVE-2020-5905 · F5 BIG-IP

    In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.

    Published 1 Jul 2020 · NVD
  5. High 8.8

    CVE-2020-5904 · F5 BIG-IP

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page.

    Published 1 Jul 2020 · NVD
  6. Medium 6.1

    CVE-2020-5903 · F5 BIG-IP

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

    Published 1 Jul 2020 · NVD
  7. Critical 9.8Actively exploited

    CVE-2020-5902 · F5 BIG-IP

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

    Published 1 Jul 2020 · Fixed in 14.1.2.6, 15.0.1.4, 15.1.0.4 · NVD
  8. High 7.5

    CVE-2020-12605 · Envoy

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.

    Published 1 Jul 2020 · NVD
  9. High 7.5

    CVE-2020-12604 · Envoy

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.

    Published 1 Jul 2020 · NVD
  10. High 7.5

    CVE-2020-12603 · Envoy

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

    Published 1 Jul 2020 · NVD
  11. Medium 4.3

    CVE-2020-4029 · Jira

    The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.

    Published 1 Jul 2020 · Fixed in 8.5.5, 8.7.2, 8.8.1 · NVD
  12. Medium 4.7

    CVE-2020-4027 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

    Published 1 Jul 2020 · Fixed in 7.5.1 · NVD
  13. Medium 4.8

    CVE-2020-4025 · Jira

    The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type.

    Published 1 Jul 2020 · Fixed in 8.5.5, 8.8.2, 8.9.1 · NVD
  14. Medium 5.4

    CVE-2020-4024 · Jira

    The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.

    Published 1 Jul 2020 · Fixed in 8.5.5, 8.8.2, 8.9.1 · NVD
  15. Medium 6.1

    CVE-2020-4022 · Jira

    The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type.

    Published 1 Jul 2020 · Fixed in 8.5.5, 8.8.2, 8.9.1 · NVD
  16. Medium 6.1

    CVE-2020-14169 · Jira

    The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability

    Published 1 Jul 2020 · Fixed in 8.9.1 · NVD
  17. Medium 5.9

    CVE-2020-14168 · Jira

    The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability.

    Published 1 Jul 2020 · Fixed in 8.5.5, 8.8.2, 8.9.1 · NVD
  18. High 7.5

    CVE-2020-14167 · Jira

    The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability.

    Published 1 Jul 2020 · Fixed in 8.5.5, 8.8.2, 8.9.1 · NVD
  19. Medium 5.3

    CVE-2020-14165 · Jira

    The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability.

    Published 1 Jul 2020 · Fixed in 8.9.0 · NVD
  20. Medium 6.1

    CVE-2020-14164 · Jira

    The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.

    Published 1 Jul 2020 · Fixed in 8.8.2 · NVD
  21. Medium 5.3

    CVE-2019-20408 · Jira

    The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

    Published 1 Jul 2020 · Fixed in 8.7.0 · NVD
  22. Unrated

    WPV-78cd6fde3ee0 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 1 Jul 2020 · Fixed in 1.6.0.2 · WPVulnerability
  23. Medium 4.8

    CVE-2019-20416 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0.

    Published 30 Jun 2020 · Fixed in 8.3.0 · NVD
  24. Medium 4.3

    CVE-2019-20415 · Jira

    Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.3, and from version 8.0.0 before 8.1.0.

    Published 30 Jun 2020 · Fixed in 7.13.3, 8.1.0 · NVD
  25. Medium 5.9

    CVE-2020-14145 · OpenSSH

    The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

    Published 29 Jun 2020 · Fixed in 8.4 · NVD
  26. Critical 10.0Actively exploited

    CVE-2020-2021 · Palo Alto Networks PAN-OS

    When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability.…

    Published 29 Jun 2020 · Fixed in 8.1.15, 9.0.9, 9.1.3 · NVD
  27. High 7.8

    CVE-2020-8022 · Apache Tomcat

    A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux…

    Published 29 Jun 2020 · Fixed in 8.0.53-29.32.1, 9.0.35-3.39.1, 9.0.35-3.57.3 · NVD
  28. Medium 5.4

    CVE-2019-20414 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

    Published 29 Jun 2020 · Fixed in 7.13.9, 8.4.2 · NVD
  29. High 7.5

    CVE-2019-20413 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserPickerBrowser.jspa page. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

    Published 29 Jun 2020 · Fixed in 7.13.9, 8.4.2 · NVD
  30. Medium 5.3

    CVE-2019-20412 · Jira

    The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types; Status Types. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

    Published 29 Jun 2020 · Fixed in 7.13.9, 8.4.2 · NVD
  31. Medium 4.3

    CVE-2019-20411 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

    Published 29 Jun 2020 · Fixed in 7.13.9, 8.4.2 · NVD
  32. Medium 6.5

    CVE-2019-20410 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2.

    Published 29 Jun 2020 · Fixed in 7.6.17, 7.13.9, 8.4.2 · NVD
  33. Medium 5.5

    CVE-2020-15358 · MySQL, SQLite

    In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

    Published 27 Jun 2020 · Fixed in 3.32.3 · NVD
  34. Critical 9.8

    CVE-2020-9632 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  35. Critical 9.8

    CVE-2020-9631 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  36. Critical 9.8

    CVE-2020-9630 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation could lead to privilege escalation.

    Published 26 Jun 2020 · NVD
  37. High 7.5

    CVE-2020-9591 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel.

    Published 26 Jun 2020 · NVD
  38. High 7.2

    CVE-2020-9588 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

    Published 26 Jun 2020 · NVD
  39. High 7.5

    CVE-2020-9587 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.

    Published 26 Jun 2020 · NVD
  40. Critical 9.8

    CVE-2020-9585 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  41. Medium 5.4

    CVE-2020-9584 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 26 Jun 2020 · NVD
  42. Critical 9.8

    CVE-2020-9583 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  43. Critical 9.8

    CVE-2020-9582 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  44. Medium 6.1

    CVE-2020-9581 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 26 Jun 2020 · NVD
  45. Critical 9.8

    CVE-2020-9580 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  46. Critical 9.8

    CVE-2020-9579 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  47. Critical 9.8

    CVE-2020-9578 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  48. Medium 6.1

    CVE-2020-9577 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure .

    Published 26 Jun 2020 · NVD
  49. Critical 9.8

    CVE-2020-9576 · Magento / Adobe Commerce

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 26 Jun 2020 · NVD
  50. Medium 6.5

    CVE-2020-3796 · Adobe ColdFusion

    ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability. Successful exploitation could lead to system file structure disclosure.

    Published 26 Jun 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.