UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,268
Published in 7 days
255
Critical in 30 days
71
Actively exploited
64

Latest vulnerabilities

11,268 vulnerabilities
  1. Medium 4.9

    CVE-2019-2774 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 23 Jul 2019 · NVD
  2. Medium 5.3

    CVE-2019-2769 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this…

    Published 23 Jul 2019 · NVD
  3. Low 3.1

    CVE-2019-2766 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human…

    Published 23 Jul 2019 · NVD
  4. Medium 5.3

    CVE-2019-2762 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this…

    Published 23 Jul 2019 · NVD
  5. Medium 5.5

    CVE-2019-2758 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Jul 2019 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD
  6. Medium 4.9

    CVE-2019-2757 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 23 Jul 2019 · NVD
  7. Medium 4.9

    CVE-2019-2755 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause…

    Published 23 Jul 2019 · NVD
  8. Medium 4.9

    CVE-2019-2752 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Jul 2019 · NVD
  9. Medium 4.9

    CVE-2019-2747 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: GIS). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Jul 2019 · NVD
  10. Medium 6.5

    CVE-2019-2746 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Data Dictionary). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Jul 2019 · NVD
  11. Medium 5.1

    CVE-2019-2745 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 23 Jul 2019 · NVD
  12. Medium 5.3

    CVE-2019-2743 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Roles). Supported versions that are affected are 8.0.12 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Jul 2019 · NVD
  13. Medium 5.3

    CVE-2019-2741 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Audit Log). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 23 Jul 2019 · NVD
  14. Medium 6.5

    CVE-2019-2740 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 23 Jul 2019 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD
  15. Medium 5.1

    CVE-2019-2739 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability…

    Published 23 Jul 2019 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD
  16. Low 3.1

    CVE-2019-2738 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Compiling). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 23 Jul 2019 · NVD
  17. Medium 4.9

    CVE-2019-2737 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 23 Jul 2019 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD
  18. Medium 5.4

    CVE-2019-2731 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some…

    Published 23 Jul 2019 · NVD
  19. Low 2.7

    CVE-2019-2730 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and prior and 5.7.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update,…

    Published 23 Jul 2019 · NVD
  20. High 7.5

    CVE-2019-14241 · HAProxy

    HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.

    Published 23 Jul 2019 · NVD
  21. High 8.1

    CVE-2015-7882 · MongoDB

    Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.

    Published 19 Jul 2019 · NVD
  22. High 7.5

    CVE-2019-13509 · Docker Engine

    In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

    Published 18 Jul 2019 · Fixed in 18.09.8 · NVD
  23. Medium 6.1

    CVE-2019-1075 · .NET

    A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.

    Published 15 Jul 2019 · NVD
  24. Medium 5.3

    CVE-2019-1010299 · Rust

    The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed…

    Published 15 Jul 2019 · Fixed in 1.30.0 · NVD
  25. Medium 4.3

    CVE-2018-20852 · Python

    http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses…

    Published 13 Jul 2019 · Fixed in 3.5.7, 3.6.9, 3.7.3 · NVD
  26. Medium 6.5

    CVE-2019-12470 · MediaWiki

    Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  27. Medium 6.5

    CVE-2019-12469 · MediaWiki

    MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  28. High 7.5

    CVE-2018-19584 · GitLab

    GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  29. Medium 6.5

    CVE-2018-19583 · GitLab

    GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  30. Medium 4.3

    CVE-2018-19582 · GitLab

    GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.

    Published 10 Jul 2019 · Fixed in 11.4.8, 11.5.1 · NVD
  31. High 7.5

    CVE-2018-19581 · GitLab

    GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user to set the weight of an issue they create.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  32. Medium 5.3

    CVE-2018-19580 · GitLab

    All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  33. Medium 5.4

    CVE-2018-19579 · GitLab

    GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1.

    Published 10 Jul 2019 · Fixed in 11.5.1 · NVD
  34. Medium 6.5

    CVE-2018-19578 · GitLab

    GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Tracing Operations page.

    Published 10 Jul 2019 · Fixed in 11.5.1 · NVD
  35. High 7.7

    CVE-2018-19571 · GitLab

    GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  36. High 7.5

    CVE-2019-12474 · MediaWiki

    Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  37. High 7.5

    CVE-2019-12473 · MediaWiki

    Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  38. High 7.5

    CVE-2019-12472 · MediaWiki

    An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  39. Medium 6.1

    CVE-2019-12471 · MediaWiki

    Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  40. High 8.8

    CVE-2019-12466 · MediaWiki

    Wikimedia MediaWiki through 1.32.1 allows CSRF.

    Published 10 Jul 2019 · NVD
  41. High 8.1

    CVE-2018-19576 · GitLab

    GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  42. Medium 4.3

    CVE-2018-19575 · GitLab

    GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  43. Medium 5.4

    CVE-2018-19574 · GitLab

    GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  44. Medium 5.4

    CVE-2018-19573 · GitLab

    GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  45. Medium 5.9

    CVE-2018-19572 · GitLab

    GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  46. Medium 5.4

    CVE-2018-19570 · GitLab

    GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  47. High 8.8

    CVE-2018-19569 · GitLab

    GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI as a user using a Personal Access Token of any scope.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  48. Critical 9.8

    CVE-2019-12468 · MediaWiki

    An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.

    Published 10 Jul 2019 · NVD
  49. Medium 5.3

    CVE-2019-12467 · MediaWiki

    MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  50. Medium 5.3

    CVE-2018-19577 · GitLab

    Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an unauthorized user the title and namespace of a confidential issue.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.