Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,273
- Published in 7 days
- 222
- Critical in 30 days
- 71
- Actively exploited
- 64
Latest vulnerabilities
11,273 vulnerabilities- Medium 6.1
CVE-2019-6264 · Joomla!
An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.
Published 16 Jan 2019 · Fixed in 3.9.2 · NVD - Medium 4.8
CVE-2019-6263 · Joomla!
An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.
Published 16 Jan 2019 · Fixed in 3.9.2 · NVD - Medium 5.4
CVE-2019-6262 · Joomla!
An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed stored XSS.
Published 16 Jan 2019 · Fixed in 3.9.2 · NVD - Medium 6.1
CVE-2019-6261 · Joomla!
An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.
Published 16 Jan 2019 · Fixed in 3.9.2 · NVD - Medium 5.3
CVE-2018-20685 · OpenSSH
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Published 10 Jan 2019 · NVD - High 7.5
CVE-2019-0564 · .NET
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.
Published 8 Jan 2019 · NVD - High 7.5
CVE-2019-0548 · .NET
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.
Published 8 Jan 2019 · NVD - Unrated
WPV-585ce4dd1d48 · WooCommerce
Vulnerability in WooCommerce
Published 7 Jan 2019 · Fixed in 3.5.1 · WPVulnerability - High 7.5
CVE-2018-20406 · Python
Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8,…
Published 23 Dec 2018 · Fixed in 3.7.1 · NVD - Medium 5.9
CVE-2018-17247 · Elasticsearch
Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they…
Published 20 Dec 2018 · NVD - Medium 6.5
CVE-2018-17244 · Elasticsearch
Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a…
Published 20 Dec 2018 · NVD - Medium 5.4
CVE-2018-20153 · WordPress
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD - Medium 6.5
CVE-2018-20152 · WordPress
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD - High 7.5
CVE-2018-20151 · WordPress
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD - Medium 6.1
CVE-2018-20150 · WordPress
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD - Medium 5.4
CVE-2018-20149 · WordPress
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD - Critical 9.8
CVE-2018-20148 · WordPress
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD - Medium 6.5
CVE-2018-20147 · WordPress
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD - High 7.5
CVE-2018-20103 · HAProxy
An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.
Published 12 Dec 2018 · NVD - High 7.5
CVE-2018-20102 · HAProxy
An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on…
Published 12 Dec 2018 · NVD - Unrated
WPV-a87de0a51483 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 12 Dec 2018 · Fixed in 6.5 · WPVulnerability - Unrated
WPV-bbaa735ff514 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 11 Dec 2018 · Fixed in 6.5 · WPVulnerability - Unrated
WPV-1c55075efed9 · WooCommerce
Vulnerability in WooCommerce
Published 11 Dec 2018 · Fixed in 3.4.6 · WPVulnerability - Unrated
WPV-9841f281bc2b · WPForms Lite
Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Published 10 Dec 2018 · Fixed in 1.4.8.1 · WPVulnerability - Unrated
WPV-91eef9642814 · Advanced Custom Fields
Vulnerability in Advanced Custom Fields (ACF®)
Published 10 Dec 2018 · Fixed in 5.7.8 · WPVulnerability - Unrated
WPV-5915ef436117 · WPForms Lite
Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Published 10 Dec 2018 · Fixed in 1.4.8.1 · WPVulnerability - High 7.5
CVE-2018-19935 · PHP
ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.
Published 7 Dec 2018 · Fixed in 7.0.33, 7.1.26, 7.2.14 · NVD - Unrated
WPV-e93844f8f8ff · WP Mail Smtp (WordPress plugin)
Vulnerability in WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP
Published 7 Dec 2018 · Fixed in 1.4.0 · WPVulnerability - Unrated
WPV-d363ba651db3 · WPForms Lite
Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Published 7 Dec 2018 · Fixed in 1.4.8 · WPVulnerability - Medium 5.4
CVE-2018-20986 · Advanced Custom Fields
Advanced Custom Fields (ACF®): Cross-site Scripting
Published 7 Dec 2018 · Fixed in 5.7.8 · NVD, WPVulnerability - Unrated
WPV-c76079ebced5 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 6 Dec 2018 · Fixed in 3.6.4 · WPVulnerability - Critical 10.0
CVE-2018-18843 · GitLab
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF.
Published 4 Dec 2018 · Fixed in 11.2.8, 11.3.9, 11.4.4 · NVD - High 7.5
CVE-2018-18648 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through an Error Message.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - Medium 6.5
CVE-2018-18647 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - High 8.8
CVE-2018-18646 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - Medium 4.3
CVE-2018-18645 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exposure via unsubscribe links in email replies.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - Medium 6.5
CVE-2018-18644 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows Information Exposure via a Gitlab Prometheus integration.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - Medium 6.1
CVE-2018-18642 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - Critical 9.8
CVE-2018-18641 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of Sensitive Information.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - Medium 6.5
CVE-2018-18640 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through Browser Caching.
Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD - Medium 6.5
CVE-2018-17976 · GitLab
An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions.
Published 4 Dec 2018 · Fixed in 11.1.8, 11.2.5, 11.3.2 · NVD - Medium 5.3
CVE-2018-17975 · GitLab
An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API.
Published 4 Dec 2018 · Fixed in 11.1.8, 11.2.5, 11.3.2 · NVD - High 7.5
CVE-2018-17939 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the merge request JSON endpoint.
Published 4 Dec 2018 · Fixed in 11.1.8, 11.2.5, 11.3.2 · NVD - Medium 6.7
CVE-2018-19792 · OpenLiteSpeed
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function.
Published 3 Dec 2018 · NVD - Medium 6.5
CVE-2018-19791 · OpenLiteSpeed
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.
Published 3 Dec 2018 · Fixed in 1.5.0 · NVD - Critical 9.8
CVE-2018-18649 · GitLab
An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for remote code execution.
Published 29 Nov 2018 · Fixed in 11.3.8, 11.4.3 · NVD - Unrated
WPV-c3dc76e07403 · WooCommerce
Vulnerability in WooCommerce
Published 29 Nov 2018 · Fixed in 3.5.2 · WPVulnerability - Medium 4.3
CVE-2018-12123 · Node.js
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the…
Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD - High 7.5
CVE-2018-12122 · Node.js
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD - High 7.5
CVE-2018-12121 · Node.js
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load…
Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.