UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,768
Published in 7 days
961
Critical in 30 days
357
Actively exploited
423

Latest vulnerabilities

39,768 vulnerabilities
  1. High 8.1

    CVE-2020-11027 · WordPress

    Password reset links invalidation issue in WordPress

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  2. High 7.5

    CVE-2020-11028 · WordPress

    WordPress: Unauthenticated disclosure of certain private posts

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  3. Medium 6.1

    CVE-2020-11029 · WordPress

    WordPress: Cross-site scripting in stats method (object cache)

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  4. Medium 5.4

    CVE-2020-11030 · WordPress

    Cross-site scripting (XSS) in Search block - WordPress

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  5. Medium 6.1

    CVE-2020-11022 · Drupal, Oracle WebLogic Server, October CMS and 7 more

    Potential XSS vulnerability in jQuery

    Published 29 Apr 2020 · Fixed in 7.70, 8.7.14, 8.8.6 · NVD, OSV.dev and GitHub, Project advisories (GitHub)
  6. Medium 6.1Actively exploited

    CVE-2020-11023 · Drupal, Oracle WebLogic Server, org.webjars.npm:jquery and 3 more

    Potential XSS vulnerability in jQuery

    Published 29 Apr 2020 · Fixed in 7.70, 8.7.14, 8.8.6 · NVD, OSV.dev and GitHub
  7. Medium 5.3

    CVE-2020-12277 · GitLab

    GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.

    Published 29 Apr 2020 · Fixed in 12.7.8, 12.8.8, 12.9.1 · NVD
  8. Medium 4.8

    CVE-2020-12276 · GitLab

    GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.

    Published 29 Apr 2020 · Fixed in 12.7.8, 12.8.8, 12.9.1 · NVD
  9. Medium 5.3

    CVE-2020-12275 · GitLab

    GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.

    Published 29 Apr 2020 · Fixed in 12.7.8, 12.8.8, 12.9.1 · NVD
  10. Medium 5.5

    CVE-2020-12459 · Grafana

    In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

    Published 29 Apr 2020 · NVD
  11. Medium 5.5

    CVE-2020-12458 · Grafana

    An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

    Published 29 Apr 2020 · NVD
  12. Medium 6.1

    CVE-2020-10797 · pfSense

    An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed.

    Published 29 Apr 2020 · Fixed in 2.4.5 · NVD
  13. Critical 9.3

    CVE-2020-3955 · VMware ESXi

    ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.3.

    Published 29 Apr 2020 · NVD
  14. Medium 4.3

    CVE-2020-4329 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks. IBM X-Force ID: 177841.

    Published 28 Apr 2020 · NVD
  15. Critical 9.8

    CVE-2020-12284 · FFmpeg

    cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.

    Published 28 Apr 2020 · NVD
  16. High 7.5

    CVE-2020-9481 · Apache Traffic Server

    Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.

    Published 27 Apr 2020 · NVD
  17. High 7.5

    CVE-2020-7067 · PHP

    In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

    Published 27 Apr 2020 · Fixed in 7.2.30, 7.3.17, 7.4.5 · NVD
  18. Low 3.7

    CVE-2020-9488 · Apache Log4j, Oracle WebLogic Server

    Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

    Published 27 Apr 2020 · Fixed in 2.3.2, 2.12.3, 2.13.2 · NVD
  19. Low 3.7

    CVE-2020-11810 · OpenVPN

    An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds)…

    Published 27 Apr 2020 · Fixed in 2.4.9 · NVD
  20. Medium 4.9

    CVE-2020-11415 · Sonatype Nexus Repository

    An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.

    Published 27 Apr 2020 · Fixed in 2.14.17, 3.22.1 · NVD
  21. Medium 6.1

    CVE-2020-12052 · Grafana

    Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

    Published 27 Apr 2020 · Fixed in 6.7.3 · NVD
  22. Medium 6.1

    CVE-2020-12245 · Grafana

    Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

    Published 24 Apr 2020 · Fixed in 6.7.3 · NVD
  23. Medium 5.3

    CVE-2020-12063 · Postfix

    A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender_login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a "Sender address rejected:…

    Published 24 Apr 2020 · NVD
  24. High 7.5

    CVE-2020-11012 · MinIO

    MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

    Published 23 Apr 2020 · Fixed in 2020-04-23t00-58-49z · NVD
  25. Critical 9.8

    CVE-2020-11945 · Squid

    An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).

    Published 23 Apr 2020 · Fixed in 4.11, 5.0.2 · NVD
  26. Medium 6.5

    CVE-2020-11649 · GitLab

    An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted.

    Published 22 Apr 2020 · Fixed in 12.7.9, 12.8.9, 12.9.3 · NVD
  27. High 7.5

    CVE-2020-11506 · GitLab

    An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) via request smuggling.

    Published 22 Apr 2020 · Fixed in 12.7.9, 12.8.9, 12.9.3 · NVD
  28. High 7.5

    CVE-2020-11505 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.

    Published 22 Apr 2020 · Fixed in 12.7.9, 12.8.9, 12.9.3 · NVD
  29. Medium 4.9

    CVE-2020-11938 · TeamCity

    In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.

    Published 22 Apr 2020 · NVD
  30. Medium 6.5

    CVE-2020-11689 · TeamCity

    In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.

    Published 22 Apr 2020 · Fixed in 2019.2.1 · NVD
  31. High 7.5

    CVE-2020-11688 · TeamCity

    In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.

    Published 22 Apr 2020 · Fixed in 2019.2.1 · NVD
  32. High 7.5

    CVE-2020-11687 · TeamCity

    In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.

    Published 22 Apr 2020 · Fixed in 2019.2.2 · NVD
  33. Low 2.7

    CVE-2020-11686 · TeamCity

    In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.

    Published 22 Apr 2020 · Fixed in 2019.1.4 · NVD
  34. Medium 6.1

    CVE-2019-20102 · Confluence

    The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter.

    Published 22 Apr 2020 · Fixed in 6.15.5 · NVD
  35. Medium 5.3

    CVE-2020-11891 · Joomla!

    An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.

    Published 21 Apr 2020 · Fixed in 3.9.17 · NVD
  36. Medium 5.3

    CVE-2020-11890 · Joomla!

    An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.

    Published 21 Apr 2020 · Fixed in 3.9.17 · NVD
  37. Medium 5.3

    CVE-2020-11889 · Joomla!

    An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.

    Published 21 Apr 2020 · Fixed in 3.9.17 · NVD
  38. High 7.5

    CVE-2020-1967 · OpenSSL, MySQL

    Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service…

    Published 21 Apr 2020 · NVD
  39. Medium 5.4

    CVE-2020-36703 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 21 Apr 2020 · Fixed in 2.9.8 · NVD, WPVulnerability
  40. High 8.8

    CVE-2020-11753 · Sonatype Nexus Repository

    An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).

    Published 20 Apr 2020 · NVD
  41. Medium 6.1

    CVE-2020-5270 · PrestaShop

    Open redirection when using back parameter

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  42. Medium 6.1

    CVE-2020-5269 · PrestaShop

    Reflected XSS on AdminFeatures page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  43. Medium 6.1

    CVE-2020-5265 · PrestaShop

    Reflected XSS on AdminAttributesGroups page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  44. Medium 6.1

    CVE-2020-5264 · PrestaShop

    Reflected XSS in security compromised page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  45. Medium 6.5

    CVE-2020-5293 · PrestaShop

    Improper access control on product page with combinations, attachments and specific prices

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  46. Medium 6.5

    CVE-2020-5288 · PrestaShop

    Improper access control on product attributes page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  47. Medium 6.5

    CVE-2020-5287 · PrestaShop

    Improper access control on customers search

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  48. Medium 6.1

    CVE-2020-5286 · PrestaShop

    Reflected XSS related in import page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  49. Medium 6.1

    CVE-2020-5285 · PrestaShop

    Reflected XSS with back parameter

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  50. Medium 6.1

    CVE-2020-5278 · PrestaShop

    Reflected XSS on Exception page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.