Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,272
- Published in 7 days
- 256
- Critical in 30 days
- 71
- Actively exploited
- 64
Latest vulnerabilities
11,272 vulnerabilities- High 8.8
CVE-2018-19569 · GitLab
GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI as a user using a Personal Access Token of any scope.
Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD - Critical 9.8
CVE-2019-12468 · MediaWiki
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.
Published 10 Jul 2019 · NVD - Medium 5.3
CVE-2019-12467 · MediaWiki
MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD - Medium 5.3
CVE-2018-19577 · GitLab
Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an unauthorized user the title and namespace of a confidential issue.
Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD - Medium 6.5
CVE-2018-19496 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone.
Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD - Medium 6.5
CVE-2018-19495 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerability in the Prometheus integration.
Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD - Medium 4.3
CVE-2018-19494 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access vulnerability that allows an unauthorized user to view private group names.
Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD - Medium 6.1
CVE-2018-19493 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding.
Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD - High 7.5
CVE-2017-7189 · PHP
main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname…
Published 10 Jul 2019 · Fixed in 7.0.16 · NVD - Critical 9.8
CVE-2019-13224 · PHP
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as…
Published 10 Jul 2019 · Fixed in 7.1.32, 7.2.23, 7.3.9 · NVD - Critical 9.8
CVE-2019-13478 · Yoast SEO
Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting
Published 9 Jul 2019 · Fixed in 11.6 · NVD, WPVulnerability - High 7.8
CVE-2019-13404 · Python
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that…
Published 8 Jul 2019 · Fixed in 3.5.0 · NVD - Unrated
WPV-fc722ffc6366 · WooCommerce
Vulnerability in WooCommerce
Published 7 Jul 2019 · Fixed in 3.6.5 · WPVulnerability - High 7.8
CVE-2019-5443 · curl, MySQL
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Published 2 Jul 2019 · NVD - Unrated
WPV-8230d792f3ee · WooCommerce
Vulnerability in WooCommerce
Published 2 Jul 2019 · Fixed in 3.6.5 · WPVulnerability - Unrated
WPV-15af68f3cd59 · WooCommerce
Vulnerability in WooCommerce
Published 2 Jul 2019 · Fixed in 3.6.5 · WPVulnerability - Medium 5.3
CVE-2019-13118 · Java
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
Published 1 Jul 2019 · NVD - Medium 5.3
CVE-2019-13117 · Java
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
Published 1 Jul 2019 · NVD - Unrated
WPV-6e89637e6d14 · Webp Converter For Media (WordPress plugin)
Vulnerability in Converter for Media – Optimize images | Convert WebP & AVIF
Published 27 Jun 2019 · Fixed in 1.0.3 · WPVulnerability - High 8.8
CVE-2019-15834 · Webp Converter For Media (WordPress plugin)
Converter for Media – Optimize images | Convert WebP & AVIF: Cross-Site Request Forgery (CSRF)
Published 27 Jun 2019 · Fixed in 1.0.3 · WPVulnerability - High 8.8
CVE-2019-10164 · PostgreSQL
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
Published 26 Jun 2019 · Fixed in 10.9, 11.4 · NVD - Unrated
WPV-d171dacac5c5 · SEO By Rank Math (WordPress plugin)
Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Published 25 Jun 2019 · Fixed in 1.0.27.1 · WPVulnerability - High 7.5
CVE-2019-10072 · Apache Tomcat
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Published 21 Jun 2019 · NVD - Medium 6.5
CVE-2019-14786 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization
Published 21 Jun 2019 · Fixed in 1.0.27.1 · WPVulnerability - Critical 9.8
CVE-2019-12900 · Python
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Published 19 Jun 2019 · Fixed in 3.8.13, 3.9.11, 3.10.3 · NVD - Critical 9.1
CVE-2019-11040 · PHP
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Published 19 Jun 2019 · Fixed in 7.1.30, 7.2.19, 7.3.6 · NVD - Critical 9.1
CVE-2019-11039 · PHP
Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
Published 19 Jun 2019 · Fixed in 7.1.30, 7.2.19, 7.3.6 · NVD - Medium 5.3
CVE-2019-11038 · PHP
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Published 19 Jun 2019 · Fixed in 7.1.30, 7.2.19, 7.3.6 · NVD - Unrated
WPV-d318cf3b79ed · SEO By Rank Math (WordPress plugin)
Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Published 18 Jun 2019 · Fixed in 1.0.27 · WPVulnerability - Unrated
WPV-49859c410c18 · SEO By Rank Math (WordPress plugin)
Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Published 18 Jun 2019 · Fixed in 1.0.27 · WPVulnerability - Medium 4.2
CVE-2019-0197 · Apache HTTP Server
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on"…
Published 11 Jun 2019 · NVD - Medium 5.3
CVE-2019-0196 · Apache HTTP Server
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.
Published 11 Jun 2019 · NVD - Medium 5.3
CVE-2019-0220 · Apache HTTP Server
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
Published 11 Jun 2019 · NVD - Medium 6.1
CVE-2019-12766 · Joomla!
An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors.
Published 11 Jun 2019 · NVD - Critical 9.8
CVE-2019-12765 · Joomla!
An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
Published 11 Jun 2019 · NVD - Medium 6.5
CVE-2019-12764 · Joomla!
An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.
Published 11 Jun 2019 · Fixed in 3.9.7 · NVD - Critical 9.8
CVE-2019-10160 · Python
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other…
Published 7 Jun 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD - Medium 6.5
CVE-2019-9866 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure.
Published 29 May 2019 · Fixed in 11.7.7, 11.8.3 · NVD - Critical 9.8
CVE-2019-9732 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.
Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Critical 9.8
CVE-2019-9485 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 5.5
CVE-2019-9221 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 3 of 5).
Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Critical 9.8
CVE-2019-9218 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 1 of 5).
Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 4.3
CVE-2019-7549 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorrect Access Control. The GitLab pipelines feature is vulnerable to authorization issues that allow unauthorized users to view job information.
Published 29 May 2019 · Fixed in 11.5.10, 11.6.8, 11.7.3 · NVD - Medium 6.1
CVE-2019-0221 · Apache Tomcat
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Published 28 May 2019 · NVD - High 7.8
CVE-2019-5436 · curl, MySQL
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
Published 28 May 2019 · NVD - Low 3.7
CVE-2019-5435 · curl
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
Published 28 May 2019 · NVD - High 7.5
CVE-2018-15664 · Docker Engine
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
Published 23 May 2019 · NVD - Medium 5.3
CVE-2017-6514 · WordPress
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.
Published 22 May 2019 · NVD - Unrated
WPV-2cc0f858820e · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 22 May 2019 · Fixed in 0.9.7.4 · WPVulnerability - Medium 4.3
CVE-2019-12215 · Matomo
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security…
Published 20 May 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.