Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,281
- Published in 7 days
- 229
- Critical in 30 days
- 72
- Actively exploited
- 64
Latest vulnerabilities
11,281 vulnerabilities- Unrated
WPV-b0684bf7a8f8 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 2 Oct 2018 · Fixed in 7.1.14 · WPVulnerability - Medium 5.9
CVE-2018-11763 · Apache HTTP Server
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
Published 25 Sept 2018 · NVD - High 7.5
CVE-2018-14647 · Python
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6,…
Published 25 Sept 2018 · NVD - High 7.5
CVE-2018-14645 · HAProxy
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.
Published 21 Sept 2018 · NVD - High 8.8
CVE-2018-3831 · Elasticsearch
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
Published 19 Sept 2018 · Fixed in 5.6.12, 6.4.1 · NVD - Medium 6.5
CVE-2018-3826 · Elasticsearch
In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.
Published 19 Sept 2018 · NVD - Unrated
WPV-01e34f670867 · WP Mail Smtp (WordPress plugin)
Vulnerability in WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP
Published 19 Sept 2018 · Fixed in 1.4.0 · WPVulnerability - Critical 9.8
CVE-2018-1000802 · Python
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered…
Published 18 Sept 2018 · Fixed in 2.7.16 · NVD - Unrated
WPV-f204757c4c2b · WPForms Lite
Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Published 18 Sept 2018 · Fixed in 1.4.8 · WPVulnerability - Medium 6.1
CVE-2018-17082 · PHP
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Published 16 Sept 2018 · Fixed in 7.0.32, 7.1.22, 7.2.10 · NVD - High 7.5
CVE-2018-8409 · .NET
A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.
Published 13 Sept 2018 · Fixed in 2.1.4 · NVD - Unrated
WPV-46ad0a1e402e · Contact Form 7
Vulnerability in Contact Form 7
Published 13 Sept 2018 · Fixed in 5.0.4 · WPVulnerability - High 7.5
CVE-2018-12608 · Docker Engine
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.
Published 10 Sept 2018 · Fixed in 17.06.0 · NVD - Medium 5.5
CVE-2016-7056 · OpenSSL
A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.
Published 10 Sept 2018 · NVD - High 8.8
CVE-2018-1000773 · WordPress
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time.
Published 6 Sept 2018 · NVD - High 8.8
CVE-2017-1000600 · WordPress
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely…
Published 6 Sept 2018 · Fixed in 4.9 · NVD - Critical 9.8
CVE-2018-14618 · curl
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On…
Published 5 Sept 2018 · Fixed in 7.61.1 · NVD - Critical 9.8
CVE-2018-20979 · Contact Form 7
Vulnerability in Contact Form 7
Published 4 Sept 2018 · Fixed in 5.0.4 · NVD, WPVulnerability - High 8.8
CVE-2018-15514 · Docker Engine
HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.
Published 1 Sept 2018 · NVD - Unrated
WPV-0341df8ecd69 · WooCommerce
Vulnerability in WooCommerce
Published 1 Sept 2018 · Fixed in 3.4.5 · WPVulnerability - Critical 9.8
CVE-2018-15882 · Joomla!
An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter.
Published 29 Aug 2018 · Fixed in 3.8.12 · NVD - High 7.5
CVE-2018-15881 · Joomla!
An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation.
Published 29 Aug 2018 · Fixed in 3.8.12 · NVD - Medium 5.4
CVE-2018-15880 · Joomla!
An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.
Published 29 Aug 2018 · Fixed in 3.8.12 · NVD - Unrated
WPV-48c496680d14 · WooCommerce
Vulnerability in WooCommerce
Published 29 Aug 2018 · Fixed in 3.4.5 · WPVulnerability - Medium 5.3
CVE-2018-15919 · OpenSSH
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
Published 28 Aug 2018 · NVD - High 7.5
CVE-2003-1605 · curl
curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
Published 23 Aug 2018 · Fixed in 7.10.7 · NVD - High 7.5
CVE-2018-7166 · Node.js
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be…
Published 21 Aug 2018 · Fixed in 10.9.0 · NVD - High 7.5
CVE-2018-12115 · Node.js
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to…
Published 21 Aug 2018 · Fixed in 6.14.4, 8.11.4, 10.9.0 · NVD - High 8.1
CVE-2016-7048 · PostgreSQL
The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.
Published 20 Aug 2018 · Fixed in 9.3.15, 9.4.10, 9.5.5 · NVD - High 7.8
CVE-2018-1000657 · Rust
Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in…
Published 20 Aug 2018 · Fixed in 1.22.0 · NVD - Medium 5.3
CVE-2018-15473 · OpenSSH
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Published 17 Aug 2018 · NVD - Medium 6.1
CVE-2016-4975 · Apache HTTP Server
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
Published 14 Aug 2018 · NVD - Medium 5.4
CVE-2018-3780 · Nextcloud
A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.
Published 13 Aug 2018 · Fixed in 13.0.5 · NVD - Medium 5.3
CVE-2018-3776 · Nextcloud
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.
Published 12 Aug 2018 · Fixed in 11.0.5, 12.0.3 · NVD - High 8.8
CVE-2018-3775 · Nextcloud
Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.
Published 12 Aug 2018 · Fixed in 12.0.3 · NVD - High 7.2
CVE-2018-14028 · WordPress
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does…
Published 10 Aug 2018 · NVD - High 8.1
CVE-2018-10925 · PostgreSQL
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular…
Published 9 Aug 2018 · Fixed in 9.5.14, 9.6.10, 10.5 · NVD - High 7.5
CVE-2018-10915 · PostgreSQL
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause…
Published 9 Aug 2018 · Fixed in 9.5.14, 9.6.10, 10.5 · NVD - High 7.5
CVE-2018-15132 · PHP
An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories.
Published 7 Aug 2018 · Fixed in 7.0.31, 7.1.20, 7.2.8 · NVD - Medium 5.4
CVE-2018-12607 · GitLab
An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding.
Published 3 Aug 2018 · Fixed in 10.7.6, 10.8.5, 11.0.1 · NVD - Medium 5.4
CVE-2018-12606 · GitLab
An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature.
Published 3 Aug 2018 · Fixed in 10.7.6, 10.8.5, 11.0.1 · NVD - Medium 5.4
CVE-2018-12605 · GitLab
An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowing arbitrary protocols as a parameter.
Published 3 Aug 2018 · Fixed in 10.7.6 · NVD - High 7.5
CVE-2018-14884 · PHP
An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.
Published 3 Aug 2018 · Fixed in 7.0.27, 7.1.13, 7.2.1 · NVD - High 7.5
CVE-2018-14883 · PHP
An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.
Published 3 Aug 2018 · Fixed in 7.0.31, 7.1.20, 7.2.8 · NVD - Medium 5.5
CVE-2018-14851 · PHP
exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.
Published 2 Aug 2018 · Fixed in 7.0.31, 7.1.20, 7.2.8 · NVD - Critical 9.8
CVE-2017-9120 · PHP
PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
Published 2 Aug 2018 · Fixed in 7.4.23, 8.0.10 · NVD - High 7.5
CVE-2017-9118 · PHP
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Published 2 Aug 2018 · Fixed in 7.4.27, 8.0.14, 8.1.1 · NVD - Medium 5.9
CVE-2018-8037 · Apache Tomcat
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and…
Published 2 Aug 2018 · NVD - High 7.5
CVE-2018-1336 · Apache Tomcat
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
Published 2 Aug 2018 · NVD - High 7.5
CVE-2018-8034 · Apache Tomcat
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
Published 1 Aug 2018 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.