UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,768
Published in 7 days
964
Critical in 30 days
357
Actively exploited
423

Latest vulnerabilities

39,768 vulnerabilities
  1. Medium 4.8

    CVE-2020-5298 · October CMS

    Reflected XSS when importing CSV files via the ImportExportController

    Published 2 Jun 2020 · Fixed in 1.0.466 · NVD, Project advisories (GitHub)
  2. Low 2.7

    CVE-2020-5297 · October CMS

    Arbitrary Upload of Whitelisted File Types by authenticated backend user with cms.manage_assets permission

    Published 2 Jun 2020 · Fixed in 1.0.466 · NVD, Project advisories (GitHub)
  3. Medium 4.9

    CVE-2020-5296 · October CMS

    Arbitrary File Deletion by authenticated backend user with cms.manage_assets permission

    Published 2 Jun 2020 · Fixed in 1.0.466 · NVD, Project advisories (GitHub)
  4. Medium 4.9

    CVE-2020-5295 · October CMS

    Local File Inclusion by authenticated backend user with cms.manage_assets permission

    Published 2 Jun 2020 · Fixed in 1.0.466 · NVD, Project advisories (GitHub)
  5. High 7.5

    CVE-2020-13763 · Joomla!

    In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  6. Medium 6.1

    CVE-2020-13762 · Joomla!

    In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  7. Medium 6.1

    CVE-2020-13761 · Joomla!

    In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  8. High 8.8

    CVE-2020-13760 · Joomla!

    In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.

    Published 2 Jun 2020 · Fixed in 3.9.19 · NVD
  9. Medium 6.1

    CVE-2018-18625 · Grafana

    Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

    Published 2 Jun 2020 · NVD
  10. Medium 6.1

    CVE-2018-18624 · Grafana

    Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

    Published 2 Jun 2020 · NVD
  11. Medium 6.1

    CVE-2018-18623 · Grafana

    Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

    Published 2 Jun 2020 · NVD
  12. Medium 6.1

    CVE-2020-10959 · MediaWiki

    resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.

    Published 2 Jun 2020 · Fixed in 1.35 · NVD
  13. High 7.5

    CVE-2020-12062 · OpenSSH

    The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing,…

    Published 1 Jun 2020 · NVD
  14. Medium 5.4

    CVE-2020-4021 · Jira

    Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view.

    Published 1 Jun 2020 · Fixed in 7.13.16, 8.5.5, 8.8.1 · NVD
  15. Low 3.3

    CVE-2020-3959 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.1.0) and VMware Fusion (11.x before 11.1.0) contain a memory leak vulnerability in the VMCI module. A malicious actor with local non-administrative access to a virtual machine may be able to crash the virtual machine's vmx process leading to a partial denial of service.

    Published 29 May 2020 · NVD
  16. Medium 5.5

    CVE-2020-3958 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.5.2) and VMware Fusion (11.x before 11.5.2) contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with non-administrative access to a virtual machine to crash the virtual machine's vmx process leading to a…

    Published 29 May 2020 · NVD
  17. Critical 9.8

    CVE-2019-6342 · Drupal

    An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.

    Published 28 May 2020 · NVD
  18. Medium 5.5

    CVE-2020-13632 · SQLite

    ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.

    Published 27 May 2020 · Fixed in 3.32.0 · NVD
  19. Medium 5.5

    CVE-2020-13631 · SQLite

    SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

    Published 27 May 2020 · Fixed in 3.32.0 · NVD
  20. High 7.0

    CVE-2020-13630 · SQLite

    ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

    Published 27 May 2020 · Fixed in 3.32.0 · NVD
  21. Medium 5.5

    CVE-2020-13435 · SQLite

    SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

    Published 24 May 2020 · NVD
  22. Medium 5.5

    CVE-2020-13434 · SQLite

    SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

    Published 24 May 2020 · NVD
  23. Medium 6.1

    CVE-2020-13430 · Grafana

    Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

    Published 24 May 2020 · Fixed in 7.0.0 · NVD
  24. High 7.5

    CVE-2020-1161 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests…

    Published 21 May 2020 · NVD
  25. High 7.5

    CVE-2020-1108 · .NET

    A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing…

    Published 21 May 2020 · NVD
  26. High 8.8

    CVE-2020-10738 · Moodle

    A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.

    Published 21 May 2020 · Fixed in 3.6.10, 3.7.6, 3.8.3 · NVD
  27. Unrated

    WPV-4a82883d2f55 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 21 May 2020 · Fixed in 1.6.0.2 · WPVulnerability
  28. Medium 4.3

    CVE-2020-8934 · Google Site Kit (WordPress plugin)

    Site Kit by Google – Analytics, Search Console, AdSense, Speed: Unchecked Return Value

    Published 21 May 2020 · Fixed in 1.8.0 · WPVulnerability
  29. High 7.0

    CVE-2020-9484 · Apache Tomcat

    When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a…

    Published 20 May 2020 · Fixed in 7.0.108, 8.5.63, 9.0.43 · NVD
  30. High 7.5

    CVE-2020-13246 · Gitea

    An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.

    Published 20 May 2020 · NVD
  31. Medium 5.4

    CVE-2020-13240 · Dolibarr ERP CRM

    The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

    Published 20 May 2020 · NVD
  32. Medium 5.4

    CVE-2020-13239 · Dolibarr ERP CRM

    The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.

    Published 20 May 2020 · NVD
  33. Critical 9.8

    CVE-2020-1955 · Apache CouchDB

    CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`. It was meant as an extension to the long standing setting `require_valid_user`, which in turn requires that any and all requests to CouchDB will have to be made with valid credentials, effectively forbidding any anonymous requests.…

    Published 20 May 2020 · NVD
  34. Medium 5.3

    CVE-2019-11048 · PHP

    In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of…

    Published 20 May 2020 · Fixed in 7.2.31, 7.3.18, 7.4.6 · NVD
  35. Medium 5.9

    CVE-2020-8617 · BIND 9

    Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND…

    Published 19 May 2020 · NVD
  36. High 8.6

    CVE-2020-8616 · BIND 9

    A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be…

    Published 19 May 2020 · NVD
  37. High 7.5

    CVE-2020-12663 · Unbound

    Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.

    Published 19 May 2020 · Fixed in 1.10.1 · NVD
  38. High 7.5

    CVE-2020-12662 · Unbound

    Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

    Published 19 May 2020 · Fixed in 1.10.1 · NVD
  39. Medium 5.4

    CVE-2020-13094 · Dolibarr ERP CRM

    Dolibarr before 11.0.4 allows XSS.

    Published 18 May 2020 · Fixed in 11.0.4 · NVD
  40. Medium 5.3

    CVE-2020-10967 · Dovecot

    In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.

    Published 18 May 2020 · Fixed in 2.3.10.1 · NVD
  41. Medium 5.3

    CVE-2020-10958 · Dovecot

    In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.

    Published 18 May 2020 · Fixed in 2.3.10.1 · NVD
  42. High 7.5

    CVE-2020-10957 · Dovecot

    In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

    Published 18 May 2020 · Fixed in 2.3.10.1 · NVD
  43. Medium 6.5

    CVE-2020-13125 · Elementor Pro (WordPress plugin)

    Vulnerability in Elementor Pro

    Published 17 May 2020 · Fixed in 2.9.4 · WPVulnerability
  44. Medium 6.1

    CVE-2020-1941 · Apache ActiveMQ

    In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.

    Published 14 May 2020 · NVD
  45. Medium 4.3

    CVE-2020-4365 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 178964.

    Published 14 May 2020 · NVD
  46. High 8.8

    CVE-2020-5577 · Movable Type

    Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable…

    Published 14 May 2020 · NVD
  47. High 8.8

    CVE-2020-5576 · Movable Type

    Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type…

    Published 14 May 2020 · NVD
  48. Medium 6.1

    CVE-2020-5575 · Movable Type

    Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5),…

    Published 14 May 2020 · NVD
  49. Medium 5.3

    CVE-2020-5574 · Movable Type

    HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced…

    Published 14 May 2020 · NVD
  50. High 8.8

    CVE-2020-11069 · TYPO3

    In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server. Scripts are then executed with the privileges of the victims' user session. In a…

    Published 14 May 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.