UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
954
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. Medium 4.3

    CVE-2019-20870 · Mattermost

    An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID.

    Published 19 Jun 2020 · Fixed in 5.10.0 · NVD
  2. Medium 5.3

    CVE-2019-20869 · Mattermost

    An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel.

    Published 19 Jun 2020 · Fixed in 5.7.3, 5.8.2, 5.9.1 · NVD
  3. High 7.5

    CVE-2019-20868 · Mattermost

    An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  4. Medium 5.3

    CVE-2019-20867 · Mattermost

    An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post.

    Published 19 Jun 2020 · Fixed in 5.11.0 · NVD
  5. Medium 5.3

    CVE-2019-20866 · Mattermost

    An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled.

    Published 19 Jun 2020 · Fixed in 5.12.0 · NVD
  6. High 8.8

    CVE-2019-20865 · Mattermost

    An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.

    Published 19 Jun 2020 · Fixed in 5.9.2, 5.10.2, 5.11.1 · NVD
  7. High 7.5

    CVE-2019-20863 · Mattermost

    An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.

    Published 19 Jun 2020 · Fixed in 5.13.0 · NVD
  8. High 7.5

    CVE-2019-20862 · Mattermost

    An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.

    Published 19 Jun 2020 · Fixed in 5.13.0 · NVD
  9. Medium 5.5

    CVE-2019-20860 · Mattermost

    An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.

    Published 19 Jun 2020 · Fixed in 5.9.4, 5.12.6, 5.13.3 · NVD
  10. High 7.5

    CVE-2019-20859 · Mattermost

    An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.

    Published 19 Jun 2020 · Fixed in 4.10.8, 5.7.3, 5.8.1 · NVD
  11. High 7.5

    CVE-2019-20858 · Mattermost

    An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL LIKE clause to an APIv4 endpoint.

    Published 19 Jun 2020 · Fixed in 5.15.0 · NVD
  12. High 7.5

    CVE-2019-20857 · Mattermost

    An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick characters.

    Published 19 Jun 2020 · Fixed in 5.16.0 · NVD
  13. High 7.5

    CVE-2019-20855 · Mattermost

    An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration.

    Published 19 Jun 2020 · Fixed in 5.14.5, 5.15.2, 5.16.1 · NVD
  14. High 7.5

    CVE-2019-20854 · Mattermost

    An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX message.

    Published 19 Jun 2020 · Fixed in 5.17.0 · NVD
  15. Critical 9.1

    CVE-2019-20851 · Mattermost

    An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.

    Published 19 Jun 2020 · Fixed in 1.26.0 · NVD
  16. Medium 6.5

    CVE-2020-14460 · Mattermost

    An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001.

    Published 19 Jun 2020 · Fixed in 5.16.5, 5.17.3, 5.18.1 · NVD
  17. High 7.5

    CVE-2020-14459 · Mattermost

    An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002.

    Published 19 Jun 2020 · Fixed in 5.19.0 · NVD
  18. High 7.5

    CVE-2020-14458 · Mattermost

    An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004.

    Published 19 Jun 2020 · Fixed in 5.19.0 · NVD
  19. Medium 5.3

    CVE-2020-14457 · Mattermost

    An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.

    Published 19 Jun 2020 · Fixed in 5.20.0 · NVD
  20. High 7.5

    CVE-2020-14453 · Mattermost

    An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005.

    Published 19 Jun 2020 · Fixed in 5.21.0 · NVD
  21. Medium 5.3

    CVE-2020-14452 · Mattermost

    An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014.

    Published 19 Jun 2020 · Fixed in 5.21.0 · NVD
  22. High 7.5

    CVE-2020-14450 · Mattermost

    An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017.

    Published 19 Jun 2020 · Fixed in 5.22.0 · NVD
  23. High 7.5

    CVE-2020-14448 · Mattermost

    An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020.

    Published 19 Jun 2020 · Fixed in 5.23.0 · NVD
  24. High 7.5

    CVE-2020-14447 · Mattermost

    An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021.

    Published 19 Jun 2020 · Fixed in 5.23.0 · NVD
  25. Medium 5.3

    CVE-2019-20847 · Mattermost

    An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.

    Published 19 Jun 2020 · Fixed in 5.18.0 · NVD
  26. High 7.5

    CVE-2019-20846 · Mattermost

    An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.

    Published 19 Jun 2020 · Fixed in 5.18.0 · NVD
  27. High 7.5

    CVE-2019-20845 · Mattermost

    An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import.

    Published 19 Jun 2020 · Fixed in 5.18.0 · NVD
  28. Medium 6.5

    CVE-2019-20844 · Mattermost

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.

    Published 19 Jun 2020 · Fixed in 5.15.4, 5.16.4, 5.17.2 · NVD
  29. High 7.5

    CVE-2019-20843 · Mattermost

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files.

    Published 19 Jun 2020 · Fixed in 5.15.4, 5.16.4, 5.17.2 · NVD
  30. High 7.2

    CVE-2019-20842 · Mattermost

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels.

    Published 19 Jun 2020 · Fixed in 5.15.4, 5.16.4, 5.17.2 · NVD
  31. High 8.8

    CVE-2019-20841 · Mattermost

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.

    Published 19 Jun 2020 · Fixed in 5.15.4, 5.16.4, 5.17.2 · NVD
  32. High 7.5

    CVE-2020-14058 · Squid

    SQUID-2020:6 Denial of Service issue in TLS handshake

    Published 19 Jun 2020 · Fixed in 4.12, 5.0.3 · NVD, Project advisories (GitHub)
  33. Medium 6.5

    CVE-2020-14059 · Squid

    SQUID-2020:5 Denial of Service when using SMP cache

    Published 19 Jun 2020 · Fixed in 5.0.3 · NVD, Project advisories (GitHub)
  34. High 8.8

    CVE-2020-14443 · Dolibarr ERP CRM

    A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

    Published 18 Jun 2020 · NVD
  35. Medium 5.9

    CVE-2020-14422 · Python

    Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10,…

    Published 18 Jun 2020 · Fixed in 3.6.12, 3.7.9, 3.8.4 · NVD
  36. High 7.2

    CVE-2020-14421 · aaPanel

    aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.

    Published 18 Jun 2020 · NVD
  37. Medium 4.9

    CVE-2020-8619 · BIND 9

    In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed…

    Published 17 Jun 2020 · NVD
  38. Medium 4.9

    CVE-2020-8618 · BIND 9

    An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.

    Published 17 Jun 2020 · NVD
  39. High 8.8

    CVE-2020-14212 · FFmpeg

    FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.

    Published 16 Jun 2020 · Fixed in 4.3.1 · NVD
  40. High 7.5

    CVE-2019-17655 · Fortinet FortiOS

    A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

    Published 16 Jun 2020 · Fixed in 6.2.3 · NVD
  41. Medium 5.3

    CVE-2020-14155 · GitLab

    libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

    Published 15 Jun 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  42. Critical 9.8

    CVE-2018-21246 · Caddy

    Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

    Published 15 Jun 2020 · Fixed in 0.10.3 · NVD
  43. Medium 6.1

    CVE-2020-9651 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  44. Medium 6.1

    CVE-2020-9648 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  45. Medium 6.1

    CVE-2020-9647 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  46. High 7.5

    CVE-2020-9645 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  47. Medium 5.4

    CVE-2020-9644 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (stored) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  48. High 7.5

    CVE-2020-9643 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  49. Medium 5.4

    CVE-2020-4046 · WordPress

    WordPress: Authenticated XSS through embed block

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  50. Medium 6.8

    CVE-2020-4047 · WordPress

    WordPress: Authenticated XSS via media attachment page

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.