UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
954
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. Medium 6.1

    CVE-2017-18879 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  2. Medium 4.3

    CVE-2017-18878 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  3. Medium 6.5

    CVE-2017-18874 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  4. Medium 6.5

    CVE-2020-13277 · GitLab

    An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5

    Published 19 Jun 2020 · NVD
  5. High 8.8

    CVE-2018-21264 · Mattermost

    An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.

    Published 19 Jun 2020 · Fixed in 4.5.2, 4.6.2 · NVD
  6. Medium 4.3

    CVE-2018-21256 · Mattermost

    An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.

    Published 19 Jun 2020 · Fixed in 5.1.0 · NVD
  7. Medium 4.3

    CVE-2018-21252 · Mattermost

    An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.

    Published 19 Jun 2020 · Fixed in 4.10.3, 5.0.3, 5.1.1 · NVD
  8. Medium 5.3

    CVE-2017-18873 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  9. Medium 4.3

    CVE-2017-18872 · Mattermost

    An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

    Published 19 Jun 2020 · Fixed in 4.3.3, 4.4.3 · NVD
  10. Medium 6.1

    CVE-2020-14475 · Dolibarr ERP CRM

    A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).

    Published 19 Jun 2020 · NVD
  11. Medium 6.5

    CVE-2020-13961 · Strapi

    Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.

    Published 19 Jun 2020 · Fixed in 3.0.2 · NVD
  12. Medium 4.3

    CVE-2019-20890 · Mattermost

    An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions.

    Published 19 Jun 2020 · Fixed in 5.7.0 · NVD
  13. Medium 5.3

    CVE-2019-20889 · Mattermost

    An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation.

    Published 19 Jun 2020 · Fixed in 4.10.5, 5.5.2, 5.6.3 · NVD
  14. High 7.5

    CVE-2019-20888 · Mattermost

    An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command integration.

    Published 19 Jun 2020 · Fixed in 4.10.5, 5.5.2, 5.6.3 · NVD
  15. Medium 4.3

    CVE-2019-20887 · Mattermost

    An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts.

    Published 19 Jun 2020 · Fixed in 5.5.3, 5.6.4, 5.7.1 · NVD
  16. High 7.5

    CVE-2019-20886 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin.

    Published 19 Jun 2020 · Fixed in 5.8.0 · NVD
  17. High 7.5

    CVE-2019-20885 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.

    Published 19 Jun 2020 · Fixed in 5.8.0 · NVD
  18. Medium 5.3

    CVE-2019-20884 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.

    Published 19 Jun 2020 · Fixed in 5.8.0 · NVD
  19. Medium 4.3

    CVE-2019-20883 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.

    Published 19 Jun 2020 · Fixed in 5.8.0 · NVD
  20. Medium 5.3

    CVE-2019-20882 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team.

    Published 19 Jun 2020 · Fixed in 5.8.0 · NVD
  21. High 7.3

    CVE-2019-20881 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.

    Published 19 Jun 2020 · Fixed in 5.8.0 · NVD
  22. High 7.5

    CVE-2019-20880 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph.

    Published 19 Jun 2020 · Fixed in 4.10.7, 5.6.5, 5.7.2 · NVD
  23. Medium 4.3

    CVE-2019-20879 · Mattermost

    An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry.

    Published 19 Jun 2020 · Fixed in 4.10.7, 5.6.5, 5.7.2 · NVD
  24. Medium 4.3

    CVE-2019-20878 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  25. Medium 5.3

    CVE-2019-20877 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  26. Medium 5.4

    CVE-2019-20876 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  27. Medium 5.3

    CVE-2019-20875 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  28. High 8.8

    CVE-2018-21263 · Mattermost

    An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response.

    Published 19 Jun 2020 · Fixed in 4.5.2, 4.6.2 · NVD
  29. High 7.5

    CVE-2018-21262 · Mattermost

    An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.

    Published 19 Jun 2020 · Fixed in 4.7.3 · NVD
  30. Medium 4.3

    CVE-2018-21261 · Mattermost

    An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.

    Published 19 Jun 2020 · Fixed in 4.6.3, 4.7.4, 4.8.1 · NVD
  31. Low 2.7

    CVE-2018-21260 · Mattermost

    An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy.

    Published 19 Jun 2020 · Fixed in 4.6.3, 4.7.4, 4.8.1 · NVD
  32. Medium 5.3

    CVE-2018-21259 · Mattermost

    An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malformed link in a channel.

    Published 19 Jun 2020 · Fixed in 4.8.2, 4.9.4, 4.10.1 · NVD
  33. High 7.5

    CVE-2018-21258 · Mattermost

    An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.

    Published 19 Jun 2020 · Fixed in 5.1.0 · NVD
  34. Medium 5.3

    CVE-2018-21257 · Mattermost

    An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command API.

    Published 19 Jun 2020 · Fixed in 5.1.0 · NVD
  35. Medium 4.3

    CVE-2018-21255 · Mattermost

    An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.

    Published 19 Jun 2020 · Fixed in 5.1.0 · NVD
  36. Medium 4.3

    CVE-2018-21254 · Mattermost

    An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.

    Published 19 Jun 2020 · Fixed in 5.1.0 · NVD
  37. Medium 4.3

    CVE-2018-21253 · Mattermost

    An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user.

    Published 19 Jun 2020 · Fixed in 4.10.2, 5.0.2 · NVD
  38. Critical 9.8

    CVE-2018-21251 · Mattermost

    An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

    Published 19 Jun 2020 · Fixed in 5.1.1 · NVD
  39. Medium 6.5

    CVE-2018-21250 · Mattermost

    An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions.

    Published 19 Jun 2020 · Fixed in 4.10.4, 5.1.2, 5.2.2 · NVD
  40. Low 3.7

    CVE-2018-21249 · Mattermost

    An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.

    Published 19 Jun 2020 · Fixed in 5.3.0 · NVD
  41. High 7.5

    CVE-2018-21248 · Mattermost

    An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.

    Published 19 Jun 2020 · Fixed in 5.4.0 · NVD
  42. Medium 6.1

    CVE-2017-18877 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  43. Medium 4.9

    CVE-2017-18876 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  44. Medium 4.9

    CVE-2017-18875 · Mattermost

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

    Published 19 Jun 2020 · Fixed in 4.1.2, 4.2.1 · NVD
  45. High 7.5

    CVE-2017-18871 · Mattermost

    An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.

    Published 19 Jun 2020 · Fixed in 4.2.2, 4.3.4, 4.4.5 · NVD
  46. Medium 4.3

    CVE-2017-18870 · Mattermost

    An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.

    Published 19 Jun 2020 · Fixed in 4.3.4, 4.4.5 · NVD
  47. High 7.5

    CVE-2019-20874 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  48. Medium 6.5

    CVE-2019-20873 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  49. Medium 5.5

    CVE-2019-20872 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  50. High 7.5

    CVE-2019-20871 · Mattermost

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.