UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,200
Published in 7 days
233
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,200 vulnerabilities
  1. Medium 6.5

    CVE-2021-39938 · GitLab

    A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  2. High 8.8

    CVE-2021-39937 · GitLab

    A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  3. Medium 4.3

    CVE-2021-39936 · GitLab

    Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker in possession of a deploy token to access a project's disabled wiki.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  4. High 7.5Actively exploited

    CVE-2021-39935 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  5. Medium 4.3

    CVE-2021-39934 · GitLab

    Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  6. Medium 6.5

    CVE-2021-39933 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a DOS attack.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  7. Medium 4.3

    CVE-2021-39932 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  8. Medium 4.3

    CVE-2021-39931 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  9. Medium 4.3

    CVE-2021-39930 · GitLab

    Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  10. Medium 4.4

    CVE-2021-39919 · GitLab

    In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  11. Medium 4.3

    CVE-2021-39918 · GitLab

    Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  12. Medium 6.5

    CVE-2021-39917 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a DOS attack.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  13. Medium 4.3

    CVE-2021-39916 · GitLab

    Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  14. Medium 5.3

    CVE-2021-39915 · GitLab

    Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  15. Medium 4.3

    CVE-2021-39910 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  16. Critical 9.8

    CVE-2021-39890 · GitLab

    It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.

    Published 6 Dec 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  17. High 7.5

    CVE-2021-22170 · GitLab

    Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content

    Published 6 Dec 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  18. Medium 6.1

    CVE-2021-25022 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 6 Dec 2021 · Fixed in 1.16.66 · NVD, WPVulnerability
  19. Medium 6.5

    CVE-2021-20867 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 2 Dec 2021 · Fixed in 5.11, 5.12.1 · NVD, WPVulnerability
  20. Medium 6.5

    CVE-2021-20866 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Missing Authorization

    Published 2 Dec 2021 · Fixed in 5.11 · NVD, WPVulnerability
  21. High 7.5

    CVE-2021-20865 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Missing Authorization

    Published 2 Dec 2021 · Fixed in 5.11 · NVD, WPVulnerability
  22. Medium 5.3

    CVE-2021-43794 · Discourse

    Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

    Published 1 Dec 2021 · Fixed in 2.7.11 · NVD
  23. Medium 4.3

    CVE-2021-43793 · Discourse

    Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse

    Published 1 Dec 2021 · Fixed in 2.7.11 · NVD
  24. Medium 4.3

    CVE-2021-43792 · Discourse

    Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications…

    Published 1 Dec 2021 · Fixed in 2.7.11 · NVD
  25. Medium 6.1

    CVE-2021-24964 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 30 Nov 2021 · Fixed in 4.4.4 · NVD, WPVulnerability
  26. Medium 4.8

    CVE-2021-24963 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 30 Nov 2021 · Fixed in 4.4.4 · NVD, WPVulnerability
  27. Medium 5.3

    CVE-2021-21707 · PHP

    In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to…

    Published 29 Nov 2021 · Fixed in 7.3.33, 7.4.26, 8.0.13 · NVD
  28. Critical 9.8

    CVE-2021-44223 · WordPress

    WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

    Published 25 Nov 2021 · Fixed in 5.8 · NVD
  29. Medium 6.5

    CVE-2021-32037 · MongoDB

    An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and…

    Published 24 Nov 2021 · NVD
  30. Medium 5.6

    CVE-2021-3672 · c-ares, Node.js

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

    Published 23 Nov 2021 · Fixed in 12.22.5, 14.17.5, 16.6.2 · NVD
  31. Medium

    CVE-2021-41190 · Docker Engine

    Ambiguous OCI manifest parsing

    Published 18 Nov 2021 · Fixed in 20.10.11 · Project advisories (GitHub)
  32. Medium 5.3

    CVE-2021-41271 · Discourse

    Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

    Published 15 Nov 2021 · NVD
  33. Medium 6.7

    CVE-2021-39913 · GitLab

    Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  34. Medium 5.3

    CVE-2021-39912 · GitLab

    A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustion.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  35. Medium 4.3

    CVE-2021-39911 · GitLab

    An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  36. Medium 5.3

    CVE-2021-39909 · GitLab

    Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  37. Medium 5.3

    CVE-2021-39907 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  38. Medium 6.1

    CVE-2021-39906 · GitLab

    Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4, 14.4.1 · NVD
  39. Medium 4.3

    CVE-2021-39905 · GitLab

    An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with

    Published 5 Nov 2021 · Fixed in 14.2.6 · NVD
  40. Medium 4.3

    CVE-2021-39904 · GitLab

    An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  41. Low 2.7

    CVE-2021-39901 · GitLab

    In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint.

    Published 5 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  42. Medium 5.3

    CVE-2021-39898 · GitLab

    In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.

    Published 5 Nov 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  43. Medium 5.3

    CVE-2021-39897 · GitLab

    Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred

    Published 5 Nov 2021 · Fixed in 12.9.8, 12.10.7 · NVD
  44. Medium 4.5

    CVE-2021-39895 · GitLab

    In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.

    Published 5 Nov 2021 · Fixed in 14.1.7, 14.2.5 · NVD
  45. Medium 5.4

    CVE-2021-22260 · GitLab

    A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf

    Published 5 Nov 2021 · Fixed in 14.0.9, 14.1.4, 14.2.2 · NVD
  46. Medium 4.3

    CVE-2021-39914 · GitLab

    A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user

    Published 4 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  47. Medium 6.5

    CVE-2021-39903 · GitLab

    In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.

    Published 4 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  48. Medium 4.3

    CVE-2021-39902 · GitLab

    Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.

    Published 4 Nov 2021 · Fixed in 14.2.6, 14.3.4 · NVD
  49. Medium

    CVE-2021-42574 · Rust

    rustc and bidirectional-override codepoints in source code

    Published 1 Nov 2021 · Project advisories (GitHub)
  50. Medium 6.5

    CVE-2021-41183 · org.webjars.npm:jquery-ui, jQuery.UI.Combined, jquery-ui-rails and 1 more

    XSS in `*Text` options of the Datepicker widget in jquery-ui

    Published 26 Oct 2021 · Fixed in 1.13.0, 7.0.0 · OSV.dev and GitHub

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.