UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
954
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. High 7.8

    CVE-2020-3768 · Adobe ColdFusion

    ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

    Published 26 Jun 2020 · NVD
  2. Medium 6.5

    CVE-2020-3767 · Adobe ColdFusion

    ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could lead to application-level denial-of-service (dos).

    Published 26 Jun 2020 · NVD
  3. High 7.5

    CVE-2020-13891 · Mattermost

    An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.

    Published 26 Jun 2020 · Fixed in 1.31.2 · NVD
  4. High 7.5

    CVE-2020-11996 · Apache Tomcat

    A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

    Published 26 Jun 2020 · NVD
  5. Medium 5.5

    CVE-2020-10727 · Apache ActiveMQ Artemis

    A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

    Published 26 Jun 2020 · NVD
  6. High 8.8

    CVE-2020-15049 · Squid

    SQUID-2020:7 Cache Poisoning Issue in HTTP Request processing

    Published 26 Jun 2020 · Fixed in 4.12, 5.0.3 · NVD, Project advisories (GitHub)
  7. Medium 5.5

    CVE-2020-3971 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201907101-SG), Workstation (15.x before 15.0.2), and Fusion (11.x before 11.0.2) contain a heap overflow vulnerability in the vmxnet3 virtual network adapter. A malicious actor with local access to a virtual machine with a vmxnet3 network adapter present may be able to read privileged information contained in physical memory.

    Published 25 Jun 2020 · NVD
  8. Low 3.8

    CVE-2020-3970 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in the Shader functionality. A malicious actor with non-administrative local access to a virtual machine with 3D graphics enabled may be able to exploit this…

    Published 25 Jun 2020 · NVD
  9. High 8.2

    CVE-2020-3968 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds write vulnerability in the USB 3.0 controller (xHCI). A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to crash the virtual…

    Published 25 Jun 2020 · NVD
  10. High 7.5

    CVE-2020-3967 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain a heap-overflow vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a…

    Published 25 Jun 2020 · NVD
  11. High 7.5

    CVE-2020-3966 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain a heap-overflow due to a race condition issue in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the…

    Published 25 Jun 2020 · NVD
  12. Medium 5.5

    CVE-2020-3965 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the XHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.

    Published 25 Jun 2020 · NVD
  13. Medium 4.7

    CVE-2020-3964 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may be able to read privileged information contained in the hypervisor's memory. Additional…

    Published 25 Jun 2020 · NVD
  14. Medium 5.5

    CVE-2020-3963 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain a use-after-free vulnerability in PVNVRAM. A malicious actor with local access to a virtual machine may be able to read privileged information contained in physical memory.

    Published 25 Jun 2020 · NVD
  15. Low 3.1

    CVE-2020-15005 · MediaWiki

    In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.

    Published 24 Jun 2020 · Fixed in 1.31.8, 1.33.4, 1.34.2 · NVD
  16. High 8.2

    CVE-2020-3962 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain a use-after-free vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on the…

    Published 24 Jun 2020 · NVD
  17. High 7.5

    CVE-2020-9494 · Apache Traffic Server

    Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.

    Published 24 Jun 2020 · NVD
  18. High 7.8

    CVE-2020-3969 · VMware ESXi

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an off-by-one heap-overflow vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on…

    Published 24 Jun 2020 · NVD
  19. Medium 5.3

    CVE-2020-4028 · Jira

    Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.

    Published 23 Jun 2020 · Fixed in 8.9.1 · NVD
  20. Critical 9.8

    CVE-2019-20409 · Jira

    The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

    Published 23 Jun 2020 · Fixed in 8.8.0 · NVD
  21. Medium 5.3

    CVE-2020-14961 · Concrete CMS

    Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.

    Published 22 Jun 2020 · Fixed in 8.5.3 · NVD
  22. Unrated

    WPV-f2795989d403 · WooCommerce

    Vulnerability in WooCommerce

    Published 22 Jun 2020 · Fixed in 4.2.1 · WPVulnerability
  23. Medium 6.5

    CVE-2020-14958 · Gogs

    In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.

    Published 21 Jun 2020 · NVD
  24. High 8.8

    CVE-2020-14950 · aaPanel

    aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request (start, stop, or restart) to the setting menu of Sotfware Store.

    Published 21 Jun 2020 · NVD
  25. Medium 5.3

    CVE-2020-13264 · GitLab

    Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  26. High 8.8

    CVE-2020-13263 · GitLab

    An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  27. Low 2.7

    CVE-2020-13261 · GitLab

    Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  28. Medium 4.3

    CVE-2020-13276 · GitLab

    User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  29. High 8.1

    CVE-2020-13275 · GitLab

    A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  30. High 7.5

    CVE-2020-13274 · GitLab

    A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  31. High 7.5

    CVE-2020-13273 · GitLab

    A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  32. High 8.8

    CVE-2020-13272 · GitLab

    OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  33. Medium 5.3

    CVE-2020-13265 · GitLab

    User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  34. Medium 6.1

    CVE-2020-13262 · GitLab

    Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link

    Published 19 Jun 2020 · Fixed in 12.9.8, 12.10.7 · NVD
  35. High 8.8

    CVE-2019-20891 · WooCommerce

    WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.

    Published 19 Jun 2020 · Fixed in 3.6.5 · NVD
  36. Medium 6.1

    CVE-2017-18921 · Mattermost

    An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.

    Published 19 Jun 2020 · Fixed in 3.5.2 · NVD
  37. Critical 9.8

    CVE-2017-18920 · Mattermost

    An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.

    Published 19 Jun 2020 · Fixed in 3.6.2 · NVD
  38. Medium 5.3

    CVE-2017-18919 · Mattermost

    An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.

    Published 19 Jun 2020 · Fixed in 3.6.3 · NVD
  39. Medium 4.9

    CVE-2017-18918 · Mattermost

    An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.

    Published 19 Jun 2020 · Fixed in 3.6.5, 3.7.3 · NVD
  40. High 7.5

    CVE-2017-18917 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  41. Medium 5.3

    CVE-2017-18916 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  42. Critical 9.8

    CVE-2017-18915 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  43. Medium 5.3

    CVE-2017-18914 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  44. Medium 6.1

    CVE-2017-18913 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  45. Critical 9.8

    CVE-2017-18908 · Mattermost

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.

    Published 19 Jun 2020 · Fixed in 3.9.2, 3.10.2 · NVD
  46. Medium 6.1

    CVE-2017-18907 · Mattermost

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.

    Published 19 Jun 2020 · Fixed in 3.9.2, 3.10.2 · NVD
  47. High 8.1

    CVE-2017-18906 · Mattermost

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.

    Published 19 Jun 2020 · Fixed in 3.9.2, 3.10.2 · NVD
  48. Medium 5.3

    CVE-2017-18905 · Mattermost

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.

    Published 19 Jun 2020 · Fixed in 3.9.2, 3.10.2 · NVD
  49. Medium 6.1

    CVE-2016-11084 · Mattermost

    An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.

    Published 19 Jun 2020 · Fixed in 2.1.0 · NVD
  50. Medium 6.1

    CVE-2016-11083 · Mattermost

    An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.

    Published 19 Jun 2020 · Fixed in 2.2.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.