UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,771
Published in 7 days
964
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,771 vulnerabilities
  1. Medium 6.1

    CVE-2020-5286 · PrestaShop

    Reflected XSS related in import page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  2. Medium 6.1

    CVE-2020-5285 · PrestaShop

    Reflected XSS with back parameter

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  3. Medium 6.1

    CVE-2020-5278 · PrestaShop

    Reflected XSS on Exception page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  4. Medium 6.1

    CVE-2020-5276 · PrestaShop

    Reflected XSS on AdminCarts page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  5. Medium 6.5

    CVE-2020-5279 · PrestaShop

    Improper Access Control

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  6. Medium 6.1

    CVE-2020-5272 · PrestaShop

    Reflected XSS on Search page

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  7. Medium 6.1

    CVE-2020-5271 · PrestaShop

    Reflected XSS with dashboard calendar

    Published 20 Apr 2020 · Fixed in 1.7.6.5 · NVD, Project advisories (GitHub)
  8. Medium 6.1

    CVE-2020-11930 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 20 Apr 2020 · Fixed in 2.8.52 · WPVulnerability
  9. Unrated

    WPV-994e6855ed09 · SEO By Rank Math (WordPress plugin)

    Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

    Published 18 Apr 2020 · Fixed in 1.0.42.2 · WPVulnerability
  10. High 7.0

    CVE-2020-1751 · GNU C Library

    An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

    Published 17 Apr 2020 · Fixed in 2.31 · NVD
  11. High 8.8

    CVE-2020-11825 · Dolibarr ERP CRM

    In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.

    Published 16 Apr 2020 · NVD
  12. Medium 5.4

    CVE-2020-11823 · Dolibarr ERP CRM

    In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.

    Published 16 Apr 2020 · NVD
  13. High 7.5

    CVE-2020-9280 · Silverstripe CMS

    In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files…

    Published 15 Apr 2020 · NVD
  14. High 7.5

    CVE-2019-12520 · Squid

    An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows…

    Published 15 Apr 2020 · NVD
  15. Critical 9.8

    CVE-2019-12519 · Squid

    An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that…

    Published 15 Apr 2020 · NVD
  16. Critical 9.8

    CVE-2019-12524 · Squid

    An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This…

    Published 15 Apr 2020 · NVD
  17. Medium 4.5

    CVE-2019-12522 · Squid

    An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.

    Published 15 Apr 2020 · NVD
  18. Medium 5.9

    CVE-2019-12521 · Squid

    An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within…

    Published 15 Apr 2020 · NVD
  19. High 7.2

    CVE-2020-2963 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover…

    Published 15 Apr 2020 · NVD
  20. Medium 5.0

    CVE-2020-2934 · Oracle WebLogic Server

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.19 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker.…

    Published 15 Apr 2020 · NVD
  21. Medium 4.4

    CVE-2020-2930 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · NVD
  22. Medium 4.9

    CVE-2020-2928 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  23. Medium 4.4

    CVE-2020-2926 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  24. Medium 4.9

    CVE-2020-2925 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 15 Apr 2020 · NVD
  25. Medium 4.9

    CVE-2020-2924 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · NVD
  26. Medium 4.9

    CVE-2020-2923 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · NVD
  27. Low 3.7

    CVE-2020-2922 · MariaDB, MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a…

    Published 15 Apr 2020 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD
  28. Medium 4.4

    CVE-2020-2921 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  29. Medium 4.9

    CVE-2020-2904 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · NVD
  30. Medium 4.9

    CVE-2020-2903 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2020 · NVD
  31. Medium 4.9

    CVE-2020-2901 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · Fixed in 5.6.47, 5.7.29, 8.0.19 · NVD
  32. Medium 4.9

    CVE-2020-2898 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Charsets). The supported version that is affected is 8.0.19. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  33. Medium 4.9

    CVE-2020-2897 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  34. Medium 4.9

    CVE-2020-2896 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  35. Medium 4.9

    CVE-2020-2895 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  36. Medium 4.9

    CVE-2020-2893 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  37. Medium 4.9

    CVE-2020-2892 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  38. Critical 9.8

    CVE-2020-2884 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of…

    Published 15 Apr 2020 · NVD
  39. Critical 9.8Actively exploited

    CVE-2020-2883 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of…

    Published 15 Apr 2020 · NVD
  40. Medium 4.3

    CVE-2020-2869 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than…

    Published 15 Apr 2020 · NVD
  41. High 8.2

    CVE-2020-2867 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation,…

    Published 15 Apr 2020 · NVD
  42. Medium 4.9

    CVE-2020-2853 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2020 · Fixed in 8.0.19 · NVD
  43. Medium 5.3

    CVE-2020-2830 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can…

    Published 15 Apr 2020 · NVD
  44. Medium 4.9

    CVE-2020-2829 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Management Services). The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 15 Apr 2020 · NVD
  45. High 7.5

    CVE-2020-2828 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services). The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 15 Apr 2020 · NVD
  46. High 7.5

    CVE-2020-2816 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE…

    Published 15 Apr 2020 · NVD
  47. Medium 4.9

    CVE-2020-2814 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause…

    Published 15 Apr 2020 · Fixed in 10.2.32, 10.3.23, 10.4.13 · NVD
  48. Medium 4.9

    CVE-2020-2812 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 15 Apr 2020 · Fixed in 10.2.32, 10.3.23, 10.4.13 · NVD
  49. Medium 6.1

    CVE-2020-2811 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than…

    Published 15 Apr 2020 · NVD
  50. Medium 5.3

    CVE-2020-2806 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling). Supported versions that are affected are 5.7.28 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 15 Apr 2020 · Fixed in 5.7.29 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.