UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,771
Published in 7 days
958
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,771 vulnerabilities
  1. High 7.5

    CVE-2020-4276 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. X-Force ID: 175984.

    Published 26 Mar 2020 · NVD
  2. High 8.8

    CVE-2020-10969 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

    Published 26 Mar 2020 · NVD
  3. High 8.8

    CVE-2020-10968 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

    Published 26 Mar 2020 · NVD
  4. Medium 6.5

    CVE-2020-10966 · Hestia Control Panel

    In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.

    Published 25 Mar 2020 · Fixed in 1.1.1 · NVD
  5. Critical 9.8

    CVE-2020-3794 · Adobe ColdFusion

    ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory.

    Published 25 Mar 2020 · NVD
  6. High 7.5

    CVE-2020-3769 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Mar 2020 · NVD
  7. High 7.5

    CVE-2020-3761 · Adobe ColdFusion

    ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. Successful exploitation could lead to arbitrary file read from the coldfusion install directory.

    Published 25 Mar 2020 · NVD
  8. High 7.5

    CVE-2020-2165 · JFrog Artifactory

    Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

    Published 25 Mar 2020 · NVD
  9. Medium 6.5

    CVE-2020-2164 · JFrog Artifactory

    Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.

    Published 25 Mar 2020 · NVD
  10. Medium 5.4

    CVE-2020-2163 · Jenkins

    Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.

    Published 25 Mar 2020 · NVD
  11. Medium 5.4

    CVE-2020-2162 · Jenkins

    Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

    Published 25 Mar 2020 · NVD
  12. Medium 5.4

    CVE-2020-2161 · Jenkins

    Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

    Published 25 Mar 2020 · NVD
  13. High 8.8

    CVE-2020-2160 · Jenkins

    Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

    Published 25 Mar 2020 · NVD
  14. Medium 6.1

    CVE-2020-11515 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Open Redirect

    Published 25 Mar 2020 · Fixed in 1.0.0.41 · WPVulnerability
  15. Critical 9.8

    CVE-2020-11514 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 25 Mar 2020 · Fixed in 1.0.0.41 · WPVulnerability
  16. High 7.5

    CVE-2020-10931 · Memcached

    Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.

    Published 24 Mar 2020 · Fixed in 1.6.2 · NVD
  17. Critical 9.8

    CVE-2020-1944 · Apache Traffic Server

    There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions.

    Published 23 Mar 2020 · NVD
  18. Critical 9.8

    CVE-2019-17565 · Apache Traffic Server

    There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versions.

    Published 23 Mar 2020 · NVD
  19. Critical 9.8

    CVE-2019-17559 · Apache Traffic Server

    There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to versions 7.1.9 and 8.0.6 or later versions.

    Published 23 Mar 2020 · NVD
  20. High 7.5

    CVE-2020-10364 · MikroTik RouterOS

    The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management.

    Published 23 Mar 2020 · NVD
  21. Critical 9.1

    CVE-2020-10661 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.

    Published 23 Mar 2020 · NVD
  22. Medium 5.3

    CVE-2020-10660 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

    Published 23 Mar 2020 · NVD
  23. Medium 4.8

    CVE-2020-10821 · Nagios XI

    Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.

    Published 22 Mar 2020 · NVD
  24. Medium 4.8

    CVE-2020-10820 · Nagios XI

    Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.

    Published 22 Mar 2020 · NVD
  25. Medium 4.8

    CVE-2020-10819 · Nagios XI

    Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.

    Published 22 Mar 2020 · NVD
  26. Medium 5.4

    CVE-2020-10803 · phpMyAdmin

    In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the…

    Published 22 Mar 2020 · Fixed in 4.9.5, 5.0.2 · NVD
  27. High 8.0

    CVE-2020-10802 · phpMyAdmin

    In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search…

    Published 22 Mar 2020 · Fixed in 4.9.5, 5.0.2 · NVD
  28. High 8.0

    CVE-2020-10804 · phpMyAdmin

    In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its…

    Published 22 Mar 2020 · Fixed in 4.9.5, 5.0.2 · NVD
  29. Medium 6.5

    CVE-2020-8139 · Nextcloud

    A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.

    Published 20 Mar 2020 · Fixed in 16.0.9, 17.0.4, 18.0.1 · NVD
  30. Medium 6.5

    CVE-2020-8138 · Nextcloud

    A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.

    Published 20 Mar 2020 · Fixed in 15.0.14, 16.0.7, 17.0.2 · NVD
  31. Medium 6.1

    CVE-2019-18860 · Squid

    SQUID-2023:6 Cross Site Scripting in cachemgr.cgi

    Published 20 Mar 2020 · Fixed in 4.9, 7.0.1 · NVD, Project advisories (GitHub)
  32. High 8.1

    CVE-2020-8134 · Ghost

    Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.

    Published 20 Mar 2020 · Fixed in 3.10.0 · NVD
  33. Critical 9.8Actively exploited

    CVE-2020-7961 · Liferay Portal / DXP

    Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

    Published 20 Mar 2020 · Fixed in 7.2.1 · NVD
  34. High 7.5

    CVE-2019-16108 · phpBB

    phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.

    Published 20 Mar 2020 · NVD
  35. High 8.8

    CVE-2020-10673 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

    Published 18 Mar 2020 · NVD
  36. High 8.8

    CVE-2020-10672 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

    Published 18 Mar 2020 · NVD
  37. High 7.5

    CVE-2019-20529 · Frappe Framework

    In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files.

    Published 18 Mar 2020 · NVD
  38. Medium 6.1

    CVE-2019-14884 · Moodle

    A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.

    Published 18 Mar 2020 · Fixed in 3.5.9, 3.6.7 · NVD
  39. Medium 5.3

    CVE-2019-14883 · Moodle

    A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token.

    Published 18 Mar 2020 · Fixed in 3.6.7, 3.7.3 · NVD
  40. Medium 6.1

    CVE-2019-14882 · Moodle

    A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.

    Published 18 Mar 2020 · NVD
  41. Medium 6.1

    CVE-2019-14881 · Moodle

    A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.

    Published 18 Mar 2020 · Fixed in 3.7.2 · NVD
  42. Medium 6.5

    CVE-2020-1720 · PostgreSQL

    A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

    Published 17 Mar 2020 · Fixed in 10.12, 11.7, 12.2 · NVD
  43. Medium 5.4

    CVE-2020-10596 · OpenCart

    OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.

    Published 17 Mar 2020 · NVD
  44. Medium 6.5

    CVE-2020-10122 · cPanel & WHM

    cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD
  45. Critical 9.8

    CVE-2020-10121 · cPanel & WHM

    cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD
  46. High 7.2

    CVE-2020-10120 · cPanel & WHM

    cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).

    Published 17 Mar 2020 · Fixed in 84.0.20 · NVD
  47. Critical 9.8

    CVE-2020-10119 · cPanel & WHM

    cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).

    Published 17 Mar 2020 · Fixed in 84.0.20 · NVD
  48. Critical 9.1

    CVE-2020-10118 · cPanel & WHM

    cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD
  49. Critical 9.1

    CVE-2020-10117 · cPanel & WHM

    cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD
  50. Medium 5.3

    CVE-2020-10116 · cPanel & WHM

    cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.