UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
954
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. Medium 6.1

    CVE-2016-11082 · Mattermost

    An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.

    Published 19 Jun 2020 · Fixed in 2.2.0 · NVD
  2. Medium 4.3

    CVE-2016-11081 · Mattermost

    An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.

    Published 19 Jun 2020 · Fixed in 2.2.0 · NVD
  3. Medium 4.3

    CVE-2016-11080 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  4. Medium 6.1

    CVE-2016-11079 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  5. Medium 6.5

    CVE-2016-11078 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  6. Low 2.7

    CVE-2016-11077 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  7. Medium 5.3

    CVE-2016-11076 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  8. Medium 5.3

    CVE-2016-11075 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  9. Critical 9.8

    CVE-2016-11074 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  10. Medium 6.1

    CVE-2016-11073 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.

    Published 19 Jun 2020 · Fixed in 3.0.0 · NVD
  11. Medium 6.5

    CVE-2016-11072 · Mattermost

    An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.

    Published 19 Jun 2020 · Fixed in 3.0.2 · NVD
  12. Medium 6.1

    CVE-2016-11071 · Mattermost

    An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.

    Published 19 Jun 2020 · Fixed in 3.1.0 · NVD
  13. Medium 5.4

    CVE-2016-11070 · Mattermost

    An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.

    Published 19 Jun 2020 · Fixed in 3.1.0 · NVD
  14. High 7.5

    CVE-2016-11069 · Mattermost

    An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.

    Published 19 Jun 2020 · Fixed in 3.2.0 · NVD
  15. Medium 5.3

    CVE-2016-11068 · Mattermost

    An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.

    Published 19 Jun 2020 · Fixed in 3.2.0 · NVD
  16. Medium 5.3

    CVE-2016-11067 · Mattermost

    An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.

    Published 19 Jun 2020 · Fixed in 3.2.0 · NVD
  17. High 7.5

    CVE-2016-11066 · Mattermost

    An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.

    Published 19 Jun 2020 · Fixed in 3.2.0 · NVD
  18. Medium 4.3

    CVE-2016-11065 · Mattermost

    An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.

    Published 19 Jun 2020 · Fixed in 3.3.0 · NVD
  19. Medium 6.1

    CVE-2016-11063 · Mattermost

    An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.

    Published 19 Jun 2020 · Fixed in 3.5.1 · NVD
  20. Medium 5.3

    CVE-2016-11062 · Mattermost

    An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.

    Published 19 Jun 2020 · Fixed in 3.5.1 · NVD
  21. High 7.5

    CVE-2015-9548 · Mattermost

    An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.

    Published 19 Jun 2020 · Fixed in 1.2.0 · NVD
  22. Critical 9.8

    CVE-2017-18912 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  23. Critical 9.1

    CVE-2017-18911 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  24. Medium 4.3

    CVE-2017-18910 · Mattermost

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links.

    Published 19 Jun 2020 · Fixed in 3.6.7, 3.7.5, 3.8.2 · NVD
  25. High 7.5

    CVE-2017-18909 · Mattermost

    An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

    Published 19 Jun 2020 · Fixed in 3.9.0 · NVD
  26. Medium 6.1

    CVE-2017-18904 · Mattermost

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.

    Published 19 Jun 2020 · Fixed in 3.9.2, 3.10.2 · NVD
  27. High 8.8

    CVE-2017-18903 · Mattermost

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.

    Published 19 Jun 2020 · Fixed in 3.9.2, 3.10.2 · NVD
  28. Medium 5.3

    CVE-2017-18902 · Mattermost

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.

    Published 19 Jun 2020 · Fixed in 3.10.3, 4.0.4 · NVD
  29. Medium 5.3

    CVE-2017-18901 · Mattermost

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.

    Published 19 Jun 2020 · Fixed in 3.10.3, 4.0.4 · NVD
  30. Critical 9.8

    CVE-2017-18900 · Mattermost

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

    Published 19 Jun 2020 · Fixed in 3.10.3, 4.0.4 · NVD
  31. Medium 5.3

    CVE-2017-18899 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  32. Medium 5.3

    CVE-2017-18898 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  33. Medium 6.1

    CVE-2017-18897 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  34. Medium 5.3

    CVE-2017-18896 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  35. Medium 5.3

    CVE-2017-18895 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  36. High 8.1

    CVE-2017-18894 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  37. Medium 6.1

    CVE-2017-18893 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  38. Medium 6.1

    CVE-2017-18892 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  39. Medium 6.1

    CVE-2017-18891 · Mattermost

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.

    Published 19 Jun 2020 · Fixed in 4.0.5, 4.1.1 · NVD
  40. Medium 4.3

    CVE-2017-18890 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  41. Medium 4.3

    CVE-2017-18889 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  42. Critical 9.8

    CVE-2017-18888 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  43. Medium 5.3

    CVE-2017-18887 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  44. High 8.8

    CVE-2017-18886 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  45. Critical 9.8

    CVE-2017-18885 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  46. High 8.1

    CVE-2017-18884 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  47. Critical 9.1

    CVE-2017-18883 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  48. Medium 6.1

    CVE-2017-18882 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  49. Medium 6.1

    CVE-2017-18881 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  50. Medium 6.1

    CVE-2017-18880 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.