UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,265
Published in 7 days
278
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,265 vulnerabilities
  1. Medium 4.8

    CVE-2019-8115 · Magento / Adobe Commerce

    A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation.

    Published 5 Nov 2019 · Fixed in 2.2.10 · NVD
  2. High 7.2

    CVE-2019-8114 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload.

    Published 5 Nov 2019 · Fixed in 1.9.4.3, 1.14.4.3, 2.2.10 · NVD
  3. Medium 5.3

    CVE-2019-8113 · Magento / Adobe Commerce

    Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  4. High 7.5

    CVE-2019-8112 · Magento / Adobe Commerce

    A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  5. High 8.8

    CVE-2019-8111 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage plugin functionality related to email templates to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  6. High 8.8

    CVE-2019-8110 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage email templates hierarchy to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  7. High 8.0

    CVE-2019-8109 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a malicious CSRF payload that can result in arbitrary command execution.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  8. Medium 6.5

    CVE-2019-8108 · Magento / Adobe Commerce

    Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate session validation setting for a storefront that leads to insecure authentication and session management.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  9. Medium 6.5

    CVE-2019-8107 · Magento / Adobe Commerce

    An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with export data transfer privileges can craft a request to perform arbitrary file deletion.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  10. High 8.8

    CVE-2019-8093 · Magento / Adobe Commerce

    An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage file upload controller for downloadable products to read/delete an arbitary files.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  11. Medium 5.4

    CVE-2019-8092 · Magento / Adobe Commerce

    A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via email template preview.

    Published 5 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  12. High 7.2

    CVE-2019-8091 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution.

    Published 5 Nov 2019 · Fixed in 1.9.4.3, 1.14.4.3 · NVD
  13. Medium 6.5

    CVE-2019-8090 · Magento / Adobe Commerce

    An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature.

    Published 5 Nov 2019 · Fixed in 2.1.19, 2.2.10, 2.3.2 · NVD
  14. High 7.5

    CVE-2019-5010 · Python

    An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

    Published 31 Oct 2019 · Fixed in 3.5.7, 3.6.9, 3.7.3 · NVD
  15. Medium 6.1

    CVE-2013-1951 · MediaWiki

    A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names.

    Published 31 Oct 2019 · Fixed in 1.19.5, 1.20.4 · NVD
  16. Medium 4.3

    CVE-2019-16251 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 31 Oct 2019 · Fixed in 2.2.14 · WPVulnerability
  17. Medium 5.3

    CVE-2019-7619 · Elasticsearch

    Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.

    Published 30 Oct 2019 · NVD
  18. Medium 6.5

    CVE-2019-8235 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled input.

    Published 30 Oct 2019 · Fixed in 2.1.17, 2.2.8, 2.3.1 · NVD
  19. Critical 9.8

    CVE-2019-10211 · PostgreSQL

    Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory.

    Published 29 Oct 2019 · Fixed in 9.6.15, 10.10, 11.5 · NVD
  20. High 7.0

    CVE-2019-10210 · PostgreSQL

    Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.

    Published 29 Oct 2019 · Fixed in 9.6.15, 10.10, 11.5 · NVD
  21. Low 2.2

    CVE-2019-10209 · PostgreSQL

    Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.

    Published 29 Oct 2019 · Fixed in 11.5 · NVD
  22. High 8.8

    CVE-2019-10208 · PostgreSQL

    A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

    Published 29 Oct 2019 · Fixed in 9.6.15, 10.10, 11.5 · NVD
  23. High 7.5

    CVE-2012-0046 · MediaWiki

    mediawiki allows deleted text to be exposed

    Published 29 Oct 2019 · Fixed in 1.17.2, 1.18.1 · NVD
  24. Critical 9.8Actively exploited

    CVE-2019-11043 · PHP

    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

    Published 28 Oct 2019 · Fixed in 7.1.33, 7.2.24, 7.3.11 · NVD
  25. Critical 9.9

    CVE-2020-7055 · Elementor

    Elementor Website Builder – more than just a page builder: Unrestricted Upload of File with Dangerous Type

    Published 28 Oct 2019 · Fixed in 2.7.5 · WPVulnerability
  26. Medium 6.1

    CVE-2019-18348 · Python

    An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947…

    Published 23 Oct 2019 · Fixed in 3.6.11, 3.7.8, 3.8.3 · NVD
  27. High 7.5

    CVE-2019-18277 · HAProxy

    A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the…

    Published 23 Oct 2019 · Fixed in 2.0.6 · NVD
  28. Unrated

    WPV-55df299305e7 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 19 Oct 2019 · WPVulnerability
  29. High 8.8

    CVE-2019-17675 · WordPress

    WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  30. Medium 5.4

    CVE-2019-17674 · WordPress

    WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  31. High 7.5

    CVE-2019-17673 · WordPress

    WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  32. Medium 6.1

    CVE-2019-17672 · WordPress

    WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  33. Medium 5.3

    CVE-2019-17671 · WordPress

    In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  34. Critical 9.8

    CVE-2019-17670 · WordPress

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  35. Critical 9.8

    CVE-2019-17669 · WordPress

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  36. Medium 4.4

    CVE-2019-3018 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 16 Oct 2019 · NVD
  37. Medium 6.5

    CVE-2019-3011 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Oct 2019 · NVD
  38. Medium 4.4

    CVE-2019-3009 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Oct 2019 · NVD
  39. Medium 6.5

    CVE-2019-3004 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Oct 2019 · NVD
  40. Medium 4.9

    CVE-2019-3003 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 16 Oct 2019 · NVD
  41. Medium 4.7

    CVE-2019-2999 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 16 Oct 2019 · NVD
  42. Medium 4.9

    CVE-2019-2998 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Oct 2019 · NVD
  43. Medium 4.9

    CVE-2019-2997 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Oct 2019 · NVD
  44. Medium 4.2

    CVE-2019-2996 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other…

    Published 16 Oct 2019 · NVD
  45. Medium 5.3

    CVE-2019-2993 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Oct 2019 · NVD
  46. Low 3.7

    CVE-2019-2992 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result…

    Published 16 Oct 2019 · NVD
  47. Medium 5.5

    CVE-2019-2991 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.017 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Oct 2019 · NVD
  48. Medium 6.8

    CVE-2019-2989 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java…

    Published 16 Oct 2019 · NVD
  49. Low 3.7

    CVE-2019-2988 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result…

    Published 16 Oct 2019 · NVD
  50. Low 3.7

    CVE-2019-2987 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)…

    Published 16 Oct 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.