UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,771
Published in 7 days
960
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,771 vulnerabilities
  1. Critical 9.8

    CVE-2020-10980 · GitLab

    GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.

    Published 8 Apr 2020 · NVD
  2. Medium 4.3

    CVE-2020-10979 · GitLab

    GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.

    Published 8 Apr 2020 · NVD
  3. Medium 5.3

    CVE-2020-10978 · GitLab

    GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.

    Published 8 Apr 2020 · NVD
  4. Medium 5.5

    CVE-2020-10977 · GitLab

    GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.

    Published 8 Apr 2020 · NVD
  5. High 7.5

    CVE-2020-10976 · GitLab

    GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.

    Published 8 Apr 2020 · NVD
  6. Medium 4.3

    CVE-2020-10975 · GitLab

    GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.

    Published 8 Apr 2020 · NVD
  7. Medium 5.3

    CVE-2020-11576 · Argo CD

    Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.

    Published 8 Apr 2020 · NVD
  8. High 8.1

    CVE-2020-11620 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

    Published 7 Apr 2020 · NVD
  9. High 8.1

    CVE-2020-11619 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

    Published 7 Apr 2020 · NVD
  10. Medium 4.3

    CVE-2020-11585 · DNN Platform

    There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter.

    Published 6 Apr 2020 · NVD
  11. Medium 6.1

    CVE-2020-11529 · Grav

    Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.

    Published 4 Apr 2020 · NVD
  12. Medium 5.3

    CVE-2020-10960 · MediaWiki

    In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for…

    Published 3 Apr 2020 · Fixed in 1.34.1 · NVD
  13. Medium 6.1

    CVE-2020-4304 · IBM WebSphere Application Server

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176670.

    Published 2 Apr 2020 · NVD
  14. Medium 6.1

    CVE-2020-4303 · IBM WebSphere Application Server

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176668.

    Published 2 Apr 2020 · NVD
  15. High 8.8

    CVE-2020-11100 · HAProxy

    In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

    Published 2 Apr 2020 · Fixed in 2.1.4 · NVD
  16. High 8.8

    CVE-2018-13371 · Fortinet FortiOS

    An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to the ZebOS component.

    Published 2 Apr 2020 · NVD
  17. High 7.8

    CVE-2020-8015 · Exim

    A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.

    Published 2 Apr 2020 · Fixed in 4.93.0.4-3.1 · NVD
  18. Medium 6.1

    CVE-2020-1927 · Apache HTTP Server

    In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

    Published 2 Apr 2020 · NVD
  19. High 8.1

    CVE-2020-6096 · GNU C Library

    An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior…

    Published 1 Apr 2020 · NVD
  20. Medium 4.3

    CVE-2018-11802 · Apache Solr

    In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the…

    Published 1 Apr 2020 · Fixed in 6.6.6, 7.7.0 · NVD
  21. Medium 6.5

    CVE-2019-11254 · Kubernetes

    The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

    Published 1 Apr 2020 · Fixed in 1.15.10, 1.16.7, 1.17.3 · NVD
  22. Medium 5.3

    CVE-2020-1934 · Apache HTTP Server

    In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.

    Published 1 Apr 2020 · NVD
  23. Medium 6.1

    CVE-2020-1943 · Apache OFBiz

    Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

    Published 1 Apr 2020 · NVD
  24. Medium 5.4

    CVE-2020-11457 · pfSense

    pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.

    Published 1 Apr 2020 · Fixed in 2.4.5 · NVD
  25. Medium 5.4

    CVE-2020-11456 · LimeSurvey

    LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).

    Published 1 Apr 2020 · NVD
  26. Critical 9.8

    CVE-2020-11455 · LimeSurvey

    LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.

    Published 1 Apr 2020 · NVD
  27. Medium 4.3

    CVE-2020-7066 · PHP

    In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

    Published 1 Apr 2020 · Fixed in 7.2.29, 7.3.16, 7.4.4 · NVD
  28. High 8.8

    CVE-2020-7065 · PHP

    In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

    Published 1 Apr 2020 · Fixed in 7.3.16, 7.4.4 · NVD
  29. Medium 5.4

    CVE-2020-7064 · PHP

    In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

    Published 1 Apr 2020 · Fixed in 7.2.29, 7.3.16, 7.4.4 · NVD
  30. High 8.8

    CVE-2020-7009 · Elasticsearch

    Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

    Published 31 Mar 2020 · Fixed in 6.8.8, 7.6.2 · NVD
  31. Medium 6.1

    CVE-2020-11441 · phpMyAdmin

    phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.

    Published 31 Mar 2020 · NVD
  32. Critical 9.1

    CVE-2019-14880 · Moodle

    A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.

    Published 31 Mar 2020 · Fixed in 3.5.9, 3.6.7, 3.7.3 · NVD
  33. High 8.8

    CVE-2020-11113 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

    Published 31 Mar 2020 · NVD
  34. High 8.8

    CVE-2020-11112 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

    Published 31 Mar 2020 · NVD
  35. High 8.8

    CVE-2020-11111 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

    Published 31 Mar 2020 · NVD
  36. Medium 6.5

    CVE-2020-20634 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 31 Mar 2020 · Fixed in 2.9.6 · NVD, WPVulnerability
  37. Medium 4.4

    CVE-2020-5284 · Next.js

    Directory Traversal in Next.js

    Published 30 Mar 2020 · Fixed in 9.3.2 · OSV.dev and GitHub, Project advisories (GitHub)
  38. Critical 9.8

    CVE-2020-10956 · GitLab

    GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.

    Published 27 Mar 2020 · Fixed in 12.9.1 · NVD
  39. Medium 6.5

    CVE-2020-10955 · GitLab

    GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.

    Published 27 Mar 2020 · Fixed in 12.9.1 · NVD
  40. High 7.5

    CVE-2020-10954 · GitLab

    GitLab through 12.9 is affected by a potential DoS in repository archive download.

    Published 27 Mar 2020 · NVD
  41. High 7.5

    CVE-2020-10953 · GitLab

    In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.

    Published 27 Mar 2020 · NVD
  42. Medium 6.5

    CVE-2020-10952 · GitLab

    GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.

    Published 27 Mar 2020 · NVD
  43. Medium 4.3

    CVE-2020-8552 · Kubernetes

    The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

    Published 27 Mar 2020 · NVD
  44. Medium 6.5

    CVE-2020-8551 · Kubernetes

    The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

    Published 27 Mar 2020 · NVD
  45. High 7.5

    CVE-2020-5862 · F5 BIG-IP

    On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider since the affected driver is specific to AWS.

    Published 27 Mar 2020 · NVD
  46. High 7.5

    CVE-2020-5861 · F5 BIG-IP

    On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors.

    Published 27 Mar 2020 · NVD
  47. High 8.1

    CVE-2020-5860 · F5 BIG-IP

    On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (HA) network failover in Device Service Cluster (DSC), the failover service does not require a strong form of authentication and HA network failover traffic is not encrypted by Transport Layer Security (TLS).

    Published 27 Mar 2020 · NVD
  48. High 7.5

    CVE-2020-5859 · F5 BIG-IP

    On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.

    Published 27 Mar 2020 · NVD
  49. High 7.8

    CVE-2020-5858 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles (for example, Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command.

    Published 27 Mar 2020 · NVD
  50. High 7.5

    CVE-2020-5857 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service.

    Published 27 Mar 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.