Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,262
- Published in 7 days
- 277
- Critical in 30 days
- 70
- Actively exploited
- 64
Latest vulnerabilities
11,262 vulnerabilities- High 7.7
CVE-2020-5258 · MySQL
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This…
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-13121 · GitLab
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13011 · GitLab
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity.
Published 10 Mar 2020 · NVD - Medium 5.9
CVE-2019-13010 · GitLab
An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. It allows Uncontrolled Resource Consumption.
Published 10 Mar 2020 · NVD - Medium 6.5
CVE-2019-13009 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.9
CVE-2019-13007 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13006 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13005 · GitLab
An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 5.3
CVE-2019-13004 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments section would become inaccessible. It has Incorrect Access Control (issue 1 of 2).
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-13003 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption.
Published 10 Mar 2020 · Fixed in 12.0.3 · NVD - Medium 4.3
CVE-2019-13002 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13001 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. It allows authentication bypass.
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-12446 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.
Published 10 Mar 2020 · NVD - Medium 5.4
CVE-2019-12445 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS.
Published 10 Mar 2020 · NVD - Medium 6.1
CVE-2019-12444 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.
Published 10 Mar 2020 · NVD - Critical 9.8
CVE-2019-12443 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks.
Published 10 Mar 2020 · NVD - Medium 6.1
CVE-2019-12442 · GitLab
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics.
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-12441 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-12434 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
Published 10 Mar 2020 · NVD - Medium 5.3
CVE-2019-12433 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-12432 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. It allows Information Disclosure.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-12431 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through the Search API. It has Improper Access Control.
Published 10 Mar 2020 · NVD - High 8.8
CVE-2019-12430 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. It allows Command Injection.
Published 10 Mar 2020 · NVD - Medium 6.5
CVE-2019-12429 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request counts of confidential issues via the milestone details page. It has Improper Access Control.
Published 10 Mar 2020 · NVD - Critical 9.8
CVE-2019-12428 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization.
Published 10 Mar 2020 · NVD - Critical 9.8
CVE-2020-8113 · GitLab
GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
Published 6 Mar 2020 · Fixed in 12.6.8 · NVD - High 7.5
CVE-2020-5247 · Ruby
In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response…
Published 28 Feb 2020 · NVD - Medium 5.3
CVE-2020-7063 · PHP
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is…
Published 27 Feb 2020 · NVD - High 7.5
CVE-2020-7062 · PHP
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
Published 27 Feb 2020 · NVD - Critical 9.1
CVE-2020-7061 · PHP
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Published 27 Feb 2020 · NVD - Medium 5.4
CVE-2020-20406 · Elementor
Elementor Website Builder – more than just a page builder: Cross-site Scripting
Published 26 Feb 2020 · Fixed in 2.9.3 · WPVulnerability - High 8.1
CVE-2020-8818 · Magento / Adobe Commerce
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback…
Published 25 Feb 2020 · NVD - Critical 9.8Actively exploited
CVE-2020-1938 · Apache Tomcat
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99,…
Published 24 Feb 2020 · Fixed in 7.0.100, 8.5.51, 9.0.31 · NVD - Medium 4.8
CVE-2020-1935 · Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a…
Published 24 Feb 2020 · NVD - Medium 4.8
CVE-2019-17569 · Apache Tomcat
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular…
Published 24 Feb 2020 · NVD - Critical 9.8
CVE-2016-4606 · curl
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Published 21 Feb 2020 · Fixed in 7.49.1 · NVD - Critical 9.8
CVE-2014-4650 · Python
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Published 20 Feb 2020 · Fixed in 3.2.6, 3.3.6, 3.4.2 · NVD - Critical 9.8
CVE-2014-3622 · PHP
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.
Published 19 Feb 2020 · Fixed in 5.6.1 · NVD - Medium 5.4
CVE-2020-10385 · WPForms Lite
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting
Published 18 Feb 2020 · Fixed in 1.5.9 · WPVulnerability - High 7.5
CVE-2020-8795 · GitLab
In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
Published 17 Feb 2020 · NVD - Medium 4.3
CVE-2019-12825 · GitLab
Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no…
Published 17 Feb 2020 · Fixed in 12.5.0 · NVD - Medium 4.3
CVE-2019-15594 · GitLab
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
Published 14 Feb 2020 · NVD - Medium 4.3
CVE-2019-15592 · GitLab
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
Published 14 Feb 2020 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD - High 7.5
CVE-2011-3336 · PHP
regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.
Published 12 Feb 2020 · NVD - High 8.1
CVE-2014-9748 · Node.js
The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.
Published 11 Feb 2020 · Fixed in 0.10.46, 0.12.15 · NVD - Critical 9.1
CVE-2020-7060 · PHP
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
Published 10 Feb 2020 · Fixed in 7.2.27, 7.3.14, 7.4.2 · NVD - Critical 9.1
CVE-2020-7059 · PHP
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
Published 10 Feb 2020 · Fixed in 7.2.27, 7.3.14, 7.4.2 · NVD - High 8.1
CVE-2012-4381 · MediaWiki
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system…
Published 8 Feb 2020 · Fixed in 1.18.5, 1.19.2 · NVD - Medium 5.3
CVE-2014-5278 · Docker Engine
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.
Published 7 Feb 2020 · Fixed in 1.2.0 · NVD - Critical 9.8
CVE-2019-15606 · Node.js
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Published 7 Feb 2020 · Fixed in 10.19.0, 12.15.0, 13.8.0 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.