Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,285
- Published in 7 days
- 233
- Critical in 30 days
- 72
- Actively exploited
- 66
Latest vulnerabilities
11,285 vulnerabilities- High 8.3
CVE-2018-2964 · Java
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u172 and 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability…
Published 18 Jul 2018 · NVD - Low 3.7
CVE-2018-2952 · Java
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171; JRockit: R28.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit.…
Published 18 Jul 2018 · NVD - High 8.3
CVE-2018-2942 · Java
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL). Supported versions that are affected are Java SE: 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability…
Published 18 Jul 2018 · NVD - High 8.3
CVE-2018-2941 · Java
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u181, 8u172 and 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the…
Published 18 Jul 2018 · NVD - Medium 4.3
CVE-2018-2940 · Java
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human…
Published 18 Jul 2018 · NVD - Critical 9.0
CVE-2018-2938 · Java
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB). Supported versions that are affected are Java SE: 6u191, 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful…
Published 18 Jul 2018 · NVD - Low 3.1
CVE-2018-2767 · MariaDB, MySQL
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…
Published 18 Jul 2018 · Fixed in 10.0.35, 10.1.33, 10.2.15 · NVD - High 7.5
CVE-2017-7468 · curl
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use…
Published 16 Jul 2018 · NVD - Medium 6.5
CVE-2018-14048 · Java
An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.
Published 13 Jul 2018 · NVD - Critical 9.8
CVE-2018-0500 · curl
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
Published 11 Jul 2018 · NVD - Medium 5.5
CVE-2018-8356 · .NET
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core…
Published 11 Jul 2018 · NVD - High 7.5
CVE-2018-8171 · .NET
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
Published 11 Jul 2018 · NVD - High 7.8
CVE-2018-1000622 · Rust
The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.
Published 9 Jul 2018 · NVD - Medium 6.5
CVE-2018-13785 · Java
In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
Published 9 Jul 2018 · NVD - Medium 5.3
CVE-2018-10892 · Docker Engine
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
Published 6 Jul 2018 · NVD - Medium 4.3
CVE-2018-3762 · Nextcloud
Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.
Published 5 Jul 2018 · Fixed in 12.0.8, 13.0.3 · NVD - High 8.1
CVE-2018-3761 · Nextcloud
Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.
Published 5 Jul 2018 · Fixed in 12.0.8, 13.0.3 · NVD - High 8.1
CVE-2017-0921 · GitLab
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.
Published 3 Jul 2018 · Fixed in 10.1.6, 10.2.6, 10.3.4 · NVD - High 7.5
CVE-2017-0919 · GitLab
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.
Published 3 Jul 2018 · Fixed in 10.1.6, 10.2.6, 10.3.4 · NVD - High 8.8
CVE-2018-12895 · WordPress
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are…
Published 26 Jun 2018 · Fixed in 4.9.7 · NVD - High 8.8
CVE-2018-12712 · Joomla!
An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.
Published 26 Jun 2018 · NVD - Medium 6.1
CVE-2018-12711 · Joomla!
An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.
Published 26 Jun 2018 · NVD - Critical 9.8
CVE-2018-12882 · PHP
exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
Published 26 Jun 2018 · NVD - High 7.2
CVE-2018-1000504 · Redirection (WordPress plugin)
Redirection: Open Redirect
Published 26 Jun 2018 · Fixed in 2.8 · WPVulnerability - Unrated
WPV-367f190b7403 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 20 Jun 2018 · Fixed in 2.8 · WPVulnerability - High 7.5
CVE-2018-1061 · Python
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
Published 19 Jun 2018 · Fixed in 2.7.15, 3.4.9 · NVD - High 7.5
CVE-2018-1333 · Apache HTTP Server
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).
Published 18 Jun 2018 · NVD - High 7.5
CVE-2018-1060 · Python
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
Published 18 Jun 2018 · Fixed in 3.4.9, 3.5.6, 3.6.5 · NVD - High 7.5
CVE-2018-7167 · Node.js
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of…
Published 13 Jun 2018 · Fixed in 6.14.3, 8.11.3, 9.11.2 · NVD - High 7.5
CVE-2018-7164 · Node.js
Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the…
Published 13 Jun 2018 · Fixed in 9.11.2, 10.4.1 · NVD - High 7.5
CVE-2018-7162 · Node.js
All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.
Published 13 Jun 2018 · Fixed in 9.11.2, 10.4.1 · NVD - High 7.5
CVE-2018-7161 · Node.js
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by…
Published 13 Jun 2018 · Fixed in 8.11.3, 9.11.2, 10.4.1 · NVD - High 7.5
CVE-2018-0732 · Node.js, OpenSSL
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected…
Published 12 Jun 2018 · Fixed in 8.8.1, 8.11.4, 10.9.0 · NVD - Critical 9.8
CVE-2016-9063 · Python
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
Published 11 Jun 2018 · Fixed in 3.4.7, 3.5.4, 3.6.2 · NVD - High 7.5
CVE-2017-16046 · MariaDB
`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Published 4 Jun 2018 · NVD - Medium 6.5
CVE-2017-16024 · Node.js
The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.
Published 4 Jun 2018 · Fixed in 0.11.9 · NVD - Medium 6.1
CVE-2018-10379 · GitLab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability.
Published 31 May 2018 · Fixed in 10.5.8, 10.6.5, 10.7.2 · NVD - Medium 5.9
CVE-2018-11469 · HAProxy
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.
Published 25 May 2018 · NVD - Critical 9.1
CVE-2018-1000301 · curl
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
Published 24 May 2018 · NVD - Critical 9.8
CVE-2018-1000300 · curl
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.
Published 24 May 2018 · NVD - Medium 6.1
CVE-2018-6378 · Joomla!
In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - Medium 4.7
CVE-2018-11328 · Joomla!
An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI containing a username and password when the Location: header cannot be used), a lack of escaping the user-info component of the URI could result in an XSS vulnerability.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - Medium 4.3
CVE-2018-11327 · Joomla!
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - Medium 4.8
CVE-2018-11326 · Joomla!
An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - Critical 9.8
CVE-2018-11325 · Joomla!
An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - Medium 5.9
CVE-2018-11324 · Joomla!
An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core or extension updates, could create a race condition where a session that was expected to be destroyed would be recreated.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - High 8.8
CVE-2018-11323 · Joomla!
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - High 7.5
CVE-2018-11322 · Joomla!
An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - Medium 6.5
CVE-2018-11321 · Joomla!
An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.
Published 22 May 2018 · Fixed in 3.8.8 · NVD - High 8.8
CVE-2018-7160 · Node.js
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to…
Published 17 May 2018 · Fixed in 6.14.0, 8.11.0, 9.10.0 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.