UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,273
Published in 7 days
222
Critical in 30 days
71
Actively exploited
64

Latest vulnerabilities

11,273 vulnerabilities
  1. Medium 4.4

    CVE-2019-2636 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Group Replication Plugin). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via MySQL Procotol to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  2. Medium 4.9

    CVE-2019-2635 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  3. Medium 5.1

    CVE-2019-2634 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 23 Apr 2019 · NVD
  4. High 7.5

    CVE-2019-2632 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to…

    Published 23 Apr 2019 · NVD
  5. Medium 4.9

    CVE-2019-2631 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Information Schema). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  6. Medium 4.4

    CVE-2019-2630 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  7. Medium 4.9

    CVE-2019-2628 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · Fixed in 10.2.24, 10.3.15, 10.4.5 · NVD
  8. Medium 4.9

    CVE-2019-2627 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 23 Apr 2019 · Fixed in 10.2.24, 10.3.15, 10.4.5 · NVD
  9. Medium 4.9

    CVE-2019-2626 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  10. Medium 4.9

    CVE-2019-2625 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  11. Medium 4.9

    CVE-2019-2624 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 23 Apr 2019 · NVD
  12. Medium 5.3

    CVE-2019-2623 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  13. Medium 4.9

    CVE-2019-2620 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  14. Medium 4.4

    CVE-2019-2617 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  15. Medium 4.4

    CVE-2019-2614 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 23 Apr 2019 · Fixed in 10.2.24, 10.3.15, 10.4.5 · NVD
  16. Medium 4.9

    CVE-2019-2607 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  17. Medium 4.9

    CVE-2019-2606 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  18. High 7.5

    CVE-2019-2602 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability…

    Published 23 Apr 2019 · NVD
  19. Medium 4.9

    CVE-2019-2596 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  20. Medium 4.9

    CVE-2019-2593 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 23 Apr 2019 · NVD
  21. Medium 4.9

    CVE-2019-2592 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: PS). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  22. Medium 4.9

    CVE-2019-2589 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  23. Medium 4.9

    CVE-2019-2587 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  24. Medium 4.9

    CVE-2019-2585 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 23 Apr 2019 · NVD
  25. Medium 4.9

    CVE-2019-2584 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  26. Medium 4.9

    CVE-2019-2581 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 23 Apr 2019 · NVD
  27. Medium 4.9

    CVE-2019-2580 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 23 Apr 2019 · NVD
  28. Medium 4.9

    CVE-2019-2566 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Audit Plug-in). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 23 Apr 2019 · NVD
  29. Medium 5.9

    CVE-2018-3123 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: libmysqld). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 23 Apr 2019 · NVD
  30. Medium 6.1

    CVE-2019-11358 · Joomla!, org.webjars.npm:jquery, jQuery and 3 more

    XSS in jQuery as used in Drupal, Backdrop CMS, and other products

    Published 20 Apr 2019 · Fixed in 2.2.2, 3.4.0, 4.3.4 · NVD, OSV.dev and GitHub
  31. High 8.8Actively exploited

    CVE-2019-3398 · Confluence

    Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code…

    Published 18 Apr 2019 · Fixed in 6.13.4, 6.14.3, 6.15.2 · NVD
  32. Critical 9.1

    CVE-2019-11035 · PHP

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

    Published 18 Apr 2019 · Fixed in 7.1.28, 7.2.17, 7.3.4 · NVD
  33. Critical 9.1

    CVE-2019-11034 · PHP

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    Published 18 Apr 2019 · Fixed in 7.1.28, 7.2.17, 7.3.4 · NVD
  34. Critical 9.1

    CVE-2019-9890 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  35. Critical 9.8

    CVE-2019-9756 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a different vulnerability than CVE-2019-9732.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.8.1 · NVD
  36. Medium 5.3

    CVE-2019-9225 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 5 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  37. Medium 5.3

    CVE-2019-9224 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 4 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  38. High 7.5

    CVE-2019-9223 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  39. High 8.1

    CVE-2019-9222 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  40. High 7.5

    CVE-2019-9220 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resource Consumption.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  41. Low 3.7

    CVE-2019-9219 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  42. Critical 9.8

    CVE-2019-9217 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Misrepresentation of Critical Information.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  43. Low 3.7

    CVE-2019-9179 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 5 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  44. Medium 5.3

    CVE-2019-9178 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 4 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  45. Medium 6.5

    CVE-2019-9176 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  46. Medium 5.3

    CVE-2019-9175 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 3 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  47. Critical 10.0

    CVE-2019-9174 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  48. Medium 5.9

    CVE-2019-9172 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 2 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  49. Low 3.7

    CVE-2019-9171 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 1 of 5).

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  50. Medium 5.3

    CVE-2019-9170 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.

    Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.