UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,273
Published in 7 days
221
Critical in 30 days
71
Actively exploited
64

Latest vulnerabilities

11,273 vulnerabilities
  1. High 8.1

    CVE-2018-12120 · Node.js

    Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the…

    Published 28 Nov 2018 · Fixed in 6.15.0 · NVD
  2. High 7.5

    CVE-2018-12116 · Node.js

    Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

    Published 28 Nov 2018 · Fixed in 6.15.0, 8.14.0 · NVD
  3. High 8.8

    CVE-2018-19520 · PHP

    An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functions such as eval, but does not prevent use of preg_replace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.

    Published 25 Nov 2018 · NVD
  4. High 7.5

    CVE-2018-19518 · PHP

    University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g.,…

    Published 25 Nov 2018 · NVD
  5. High 7.5

    CVE-2018-19396 · PHP

    ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.

    Published 20 Nov 2018 · NVD
  6. High 7.5

    CVE-2018-19395 · PHP

    ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell").

    Published 20 Nov 2018 · NVD
  7. Unrated

    WPV-deceef5f25eb · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Nov 2018 · Fixed in 9.2.0 · WPVulnerability
  8. High 8.1

    CVE-2018-16396 · Ruby

    An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

    Published 16 Nov 2018 · NVD
  9. Critical 9.8

    CVE-2018-16395 · Ruby

    An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a…

    Published 16 Nov 2018 · NVD
  10. High 8.8

    CVE-2018-19296 · WordPress

    PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

    Published 16 Nov 2018 · NVD
  11. Medium 4.7

    CVE-2018-5407 · Node.js, OpenSSL

    Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

    Published 15 Nov 2018 · Fixed in 6.14.4, 8.11.4, 10.9.0 · NVD
  12. Medium 6.5

    CVE-2018-8416 · .NET

    A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

    Published 14 Nov 2018 · NVD
  13. Unrated

    WPV-5af05bf9a2a3 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 14 Nov 2018 · Fixed in 3.6.4 · WPVulnerability
  14. Critical 9.8

    CVE-2018-16850 · PostgreSQL

    postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

    Published 13 Nov 2018 · Fixed in 10.6, 11.1 · NVD
  15. Medium 6.1

    CVE-2018-16845 · nginx

    nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the…

    Published 7 Nov 2018 · NVD
  16. High 7.5

    CVE-2018-16844 · nginx

    nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

    Published 7 Nov 2018 · Fixed in 1.14.1, 1.15.6 · NVD
  17. High 7.5

    CVE-2018-16843 · nginx

    nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

    Published 7 Nov 2018 · Fixed in 1.14.1, 1.15.6 · NVD
  18. Unrated

    WPV-1e428416175d · WooCommerce

    Vulnerability in WooCommerce

    Published 7 Nov 2018 · Fixed in 3.4.6 · WPVulnerability
  19. High 8.1

    CVE-2018-20714 · WooCommerce

    WooCommerce: Path Traversal

    Published 6 Nov 2018 · Fixed in 3.4.6 · NVD, WPVulnerability
  20. Medium 6.6

    CVE-2018-19370 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Race Condition

    Published 6 Nov 2018 · Fixed in 9.2.0 · NVD, WPVulnerability
  21. Critical 9.1

    CVE-2018-16842 · curl

    Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

    Published 31 Oct 2018 · NVD
  22. Critical 9.8

    CVE-2018-16840 · curl

    A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

    Published 31 Oct 2018 · Fixed in 7.62.0 · NVD
  23. Critical 9.8

    CVE-2018-16839 · curl

    Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

    Published 31 Oct 2018 · NVD
  24. Medium 5.3

    CVE-2018-16467 · Nextcloud

    A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.

    Published 30 Oct 2018 · Fixed in 14.0.0 · NVD
  25. High 8.1

    CVE-2018-16466 · Nextcloud

    Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.

    Published 30 Oct 2018 · Fixed in 12.0.11, 13.0.6 · NVD
  26. Medium 5.3

    CVE-2018-16465 · Nextcloud

    Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.

    Published 30 Oct 2018 · Fixed in 14.0.0 · NVD
  27. Medium 5.7

    CVE-2018-16464 · Nextcloud

    A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.

    Published 30 Oct 2018 · Fixed in 14.0.0 · NVD
  28. Low 3.1

    CVE-2018-16463 · Nextcloud

    A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.

    Published 30 Oct 2018 · Fixed in 12.0.8, 13.0.3 · NVD
  29. Medium 5.9

    CVE-2018-0734 · Node.js, OpenSSL

    The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

    Published 30 Oct 2018 · Fixed in 6.15.0, 8.14.0, 11.3.0 · NVD
  30. Medium 5.9

    CVE-2018-0735 · Node.js, OpenSSL, MySQL

    The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

    Published 29 Oct 2018 · Fixed in 10.12.0, 11.3.0 · NVD
  31. Unrated

    WPV-86f439a16ac7 · WooCommerce

    Vulnerability in WooCommerce

    Published 29 Oct 2018 · Fixed in 3.4.6 · WPVulnerability
  32. Unrated

    WPV-a3aa81b9c68d · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 18 Oct 2018 · Fixed in 2.10 · WPVulnerability
  33. Medium 4.3

    CVE-2018-3286 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete…

    Published 17 Oct 2018 · NVD
  34. Medium 4.9

    CVE-2018-3285 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Windows). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2018 · NVD
  35. Medium 4.4

    CVE-2018-3284 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2018 · Fixed in 10.2.19, 10.3.11 · NVD
  36. Medium 4.4

    CVE-2018-3283 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Logging). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 17 Oct 2018 · NVD
  37. Medium 4.9

    CVE-2018-3282 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can…

    Published 17 Oct 2018 · Fixed in 10.1.37, 10.2.19, 10.3.11 · NVD
  38. Medium 4.9

    CVE-2018-3280 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: JSON). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2018 · NVD
  39. Medium 4.9

    CVE-2018-3279 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Roles). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2018 · NVD
  40. Medium 4.9

    CVE-2018-3278 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: RBR). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 17 Oct 2018 · NVD
  41. Medium 4.9

    CVE-2018-3277 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2018 · Fixed in 10.2.19, 10.3.11 · NVD
  42. Medium 4.9

    CVE-2018-3276 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 17 Oct 2018 · NVD
  43. Medium 6.5

    CVE-2018-3251 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 17 Oct 2018 · Fixed in 10.1.37, 10.2.19, 10.3.11 · NVD
  44. Medium 5.5

    CVE-2018-3247 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Merge). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 17 Oct 2018 · NVD
  45. Medium 5.3

    CVE-2018-3214 · Java

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound). Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful…

    Published 17 Oct 2018 · NVD
  46. Medium 4.9

    CVE-2018-3212 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Information Schema). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2018 · NVD
  47. Medium 6.6

    CVE-2018-3211 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serviceability). Supported versions that are affected are Java SE: 8u182 and 11; Java SE Embedded: 8u181. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. Successful attacks…

    Published 17 Oct 2018 · NVD
  48. High 8.3

    CVE-2018-3209 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). The supported version that is affected is Java SE: 8u182. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE,…

    Published 17 Oct 2018 · NVD
  49. Medium 6.5

    CVE-2018-3203 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2018 · NVD
  50. Medium 4.9

    CVE-2018-3200 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2018 · Fixed in 10.2.19, 10.3.11 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.