UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,768
Published in 7 days
965
Critical in 30 days
357
Actively exploited
423

Latest vulnerabilities

39,768 vulnerabilities
  1. High 7.5

    CVE-2019-17655 · Fortinet FortiOS

    A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.

    Published 16 Jun 2020 · Fixed in 6.2.3 · NVD
  2. Medium 5.3

    CVE-2020-14155 · GitLab

    libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

    Published 15 Jun 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  3. Critical 9.8

    CVE-2018-21246 · Caddy

    Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

    Published 15 Jun 2020 · Fixed in 0.10.3 · NVD
  4. Medium 6.1

    CVE-2020-9651 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  5. Medium 6.1

    CVE-2020-9648 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  6. Medium 6.1

    CVE-2020-9647 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  7. High 7.5

    CVE-2020-9645 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  8. Medium 5.4

    CVE-2020-9644 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (stored) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  9. High 7.5

    CVE-2020-9643 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 12 Jun 2020 · Fixed in 6.4.8.1, 6.5.5.0 · NVD
  10. Medium 5.4

    CVE-2020-4046 · WordPress

    WordPress: Authenticated XSS through embed block

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  11. Medium 6.8

    CVE-2020-4047 · WordPress

    WordPress: Authenticated XSS via media attachment page

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  12. Medium 5.7

    CVE-2020-4048 · WordPress

    WordPress: Open redirect in wp_validate_redirect()

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  13. Low 2.4

    CVE-2020-4049 · WordPress

    WordPress: Authenticated self-XSS via theme uploads

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  14. Low 3.1

    CVE-2020-4050 · WordPress

    WordPress: 'set-screen-option' filter misuse by plugins leading to privilege escalation

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  15. High 8.8

    CVE-2020-13445 · Liferay Portal / DXP

    In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

    Published 10 Jun 2020 · NVD
  16. Medium 6.5

    CVE-2020-13444 · Liferay Portal / DXP

    Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.

    Published 10 Jun 2020 · NVD
  17. High 7.5

    CVE-2020-13223 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.

    Published 10 Jun 2020 · Fixed in 1.3.6, 1.4.2 · NVD
  18. Critical 9.8

    CVE-2020-12757 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

    Published 10 Jun 2020 · Fixed in 1.4.2 · NVD
  19. High 7.2

    CVE-2020-2029 · Palo Alto Networks PAN-OS

    An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions of PAN-OS 8.0; PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than…

    Published 10 Jun 2020 · Fixed in 7.1.26, 8.1.13 · NVD
  20. High 7.2

    CVE-2020-2028 · Palo Alto Networks PAN-OS

    An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7.

    Published 10 Jun 2020 · Fixed in 8.1.13, 9.0.7 · NVD
  21. High 7.2

    CVE-2020-2027 · Palo Alto Networks PAN-OS

    A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7.

    Published 10 Jun 2020 · Fixed in 8.1.13, 9.0.7 · NVD
  22. Medium 6.1

    CVE-2020-13271 · GitLab

    A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1

    Published 10 Jun 2020 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
  23. High 8.8

    CVE-2020-13270 · GitLab

    Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API

    Published 10 Jun 2020 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
  24. Medium 6.1

    CVE-2020-13269 · GitLab

    A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1

    Published 10 Jun 2020 · Fixed in 12.10.7, 13.0.1 · NVD
  25. Medium 5.3

    CVE-2020-13268 · GitLab

    A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1

    Published 10 Jun 2020 · NVD
  26. Medium 6.1

    CVE-2020-13267 · GitLab

    A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1

    Published 10 Jun 2020 · NVD
  27. Medium 6.1

    CVE-2020-36172 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Cross-site Scripting

    Published 10 Jun 2020 · Fixed in 5.8.12 · NVD, WPVulnerability
  28. Medium 4.3

    CVE-2020-13266 · GitLab

    Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions

    Published 9 Jun 2020 · NVD
  29. Medium 4.8

    CVE-2020-13980 · OpenCart

    OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you are still required to be logged into the admin.

    Published 9 Jun 2020 · NVD
  30. Medium 6.1Actively exploited

    CVE-2020-13965 · Roundcube

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

    Published 9 Jun 2020 · Fixed in 1.3.12, 1.4.5 · NVD
  31. Medium 6.1

    CVE-2020-13964 · Roundcube

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.

    Published 9 Jun 2020 · Fixed in 1.3.12, 1.4.5 · NVD
  32. High 7.5

    CVE-2020-13625 · PHPMailer

    PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

    Published 8 Jun 2020 · Fixed in 6.1.6 · NVD
  33. High 7.4

    CVE-2020-8172 · Node.js

    TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

    Published 8 Jun 2020 · Fixed in 12.18.0, 14.4.0 · NVD
  34. Medium 5.5

    CVE-2020-13904 · FFmpeg

    FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.

    Published 7 Jun 2020 · NVD
  35. High 7.1

    CVE-2020-13902 · ImageMagick

    ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.

    Published 7 Jun 2020 · NVD
  36. High 7.5

    CVE-2020-13871 · SQLite

    SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

    Published 6 Jun 2020 · NVD
  37. Medium 6.3

    CVE-2020-8555 · Kubernetes

    The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

    Published 5 Jun 2020 · Fixed in 1.15.11, 1.16.9, 1.17.5 · NVD
  38. Critical 9.8

    CVE-2020-4450 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181231.

    Published 5 Jun 2020 · Fixed in 8.5.5.18, 9.0.5.5 · NVD
  39. High 7.5

    CVE-2020-4449 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230.

    Published 5 Jun 2020 · NVD
  40. Critical 9.8

    CVE-2020-4448 · IBM WebSphere Application Server

    IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228.

    Published 5 Jun 2020 · Fixed in 8.5.5.18, 9.0.5.4 · NVD
  41. Medium 5.4

    CVE-2020-13865 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 5 Jun 2020 · Fixed in 2.9.10 · WPVulnerability
  42. Medium 5.4

    CVE-2020-13864 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 5 Jun 2020 · Fixed in 2.9.9 · WPVulnerability
  43. High 7.5

    CVE-2020-11080 · Node.js, MySQL

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this…

    Published 3 Jun 2020 · Fixed in 10.21.0, 12.18.0 · NVD
  44. High 8.2

    CVE-2020-13379 · Grafana

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana…

    Published 3 Jun 2020 · NVD
  45. Medium 5.4

    CVE-2020-7015 · Kibana

    Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization.

    Published 3 Jun 2020 · Fixed in 6.8.10, 7.7.1 · NVD
  46. High 8.8

    CVE-2020-7014 · Elasticsearch

    The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with…

    Published 3 Jun 2020 · NVD
  47. High 7.2

    CVE-2020-7013 · Kibana

    Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

    Published 3 Jun 2020 · Fixed in 6.8.9, 7.7.0 · NVD
  48. High 8.8

    CVE-2020-7012 · Kibana

    Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

    Published 3 Jun 2020 · NVD
  49. High 8.0

    CVE-2020-12846 · Zimbra Collaboration

    Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored…

    Published 3 Jun 2020 · Fixed in 8.8.15 · NVD
  50. Medium 5.1

    CVE-2020-5299 · October CMS

    Potential CSV Injection vector

    Published 2 Jun 2020 · Fixed in 1.0.466 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.