UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,331
Published in 7 days
277
Critical in 30 days
73
Actively exploited
66

Latest vulnerabilities

11,331 vulnerabilities
  1. Medium 4.4

    CVE-2018-2762 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection). Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 19 Apr 2018 · NVD
  2. Medium 5.9

    CVE-2018-2761 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 19 Apr 2018 · Fixed in 10.0.35, 10.1.33, 10.2.15 · NVD
  3. Medium 4.9

    CVE-2018-2759 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 19 Apr 2018 · Fixed in 10.2.15 · NVD
  4. Medium 6.5

    CVE-2018-2758 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 19 Apr 2018 · NVD
  5. High 7.7

    CVE-2018-2755 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction…

    Published 19 Apr 2018 · Fixed in 10.0.35, 10.1.33, 10.2.15 · NVD
  6. Medium 5.9

    CVE-2018-0737 · OpenSSL

    The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

    Published 16 Apr 2018 · NVD
  7. Medium 6.1

    CVE-2018-10102 · WordPress

    Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.

    Published 16 Apr 2018 · Fixed in 4.9.5 · NVD
  8. Medium 6.1

    CVE-2018-10101 · WordPress

    Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

    Published 16 Apr 2018 · Fixed in 4.9.5 · NVD
  9. Medium 6.1

    CVE-2018-10100 · WordPress

    Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.

    Published 16 Apr 2018 · Fixed in 4.9.5 · NVD
  10. Medium 5.3

    CVE-2014-1686 · MediaWiki

    MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation.

    Published 16 Apr 2018 · NVD
  11. Critical 9.8

    CVE-2017-0372 · MediaWiki

    Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.

    Published 13 Apr 2018 · NVD
  12. Medium 5.3

    CVE-2017-0370 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  13. Medium 6.5

    CVE-2017-0369 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  14. Medium 5.3

    CVE-2017-0368 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  15. High 8.8

    CVE-2017-0367 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  16. Medium 5.4

    CVE-2017-0366 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  17. Medium 4.7

    CVE-2017-0365 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  18. Medium 6.1

    CVE-2017-0364 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  19. Medium 6.1

    CVE-2017-0363 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  20. High 8.8

    CVE-2017-0362 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  21. High 7.8

    CVE-2017-0361 · MediaWiki

    Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.

    Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD
  22. High 8.1

    CVE-2014-6412 · WordPress

    WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

    Published 12 Apr 2018 · Fixed in 4.4.0 · NVD
  23. Medium 6.1

    CVE-2018-9244 · GitLab

    GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7.

    Published 5 Apr 2018 · Fixed in 10.4.7, 10.5.7, 10.6.3 · NVD
  24. Medium 6.1

    CVE-2018-9243 · GitLab

    GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically, filenames in changes tabs of merge requests). This is fixed in 10.6.3, 10.5.7, and 10.4.7.

    Published 5 Apr 2018 · Fixed in 10.4.7, 10.5.7, 10.6.3 · NVD
  25. Critical 9.1

    CVE-2018-8780 · Ruby

    In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.

    Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD
  26. High 7.5

    CVE-2018-8779 · Ruby

    In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.

    Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD
  27. High 7.5

    CVE-2018-8778 · Ruby

    In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.

    Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD
  28. High 7.5

    CVE-2018-8777 · Ruby

    In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).

    Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD
  29. High 7.5

    CVE-2018-6914 · Ruby

    Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.

    Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD
  30. Medium 5.3

    CVE-2017-17742 · Ruby

    Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

    Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD
  31. Critical 9.8

    CVE-2018-9230 · OpenResty

    In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall (ngx_lua_waf or X-WAF) products. NOTE: the vendor has reported that 100 parameters is an…

    Published 2 Apr 2018 · Fixed in 1.13.6.1 · NVD
  32. Medium 5.7

    CVE-2017-0936 · Nextcloud

    Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.

    Published 28 Mar 2018 · Fixed in 11.0.7 · NVD
  33. Medium 6.5

    CVE-2018-0739 · OpenSSL

    Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o…

    Published 27 Mar 2018 · NVD
  34. Medium 5.9

    CVE-2018-0733 · OpenSSL

    Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX…

    Published 27 Mar 2018 · NVD
  35. Critical 9.8

    CVE-2018-1312 · Apache HTTP Server

    In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

    Published 26 Mar 2018 · NVD
  36. High 7.5

    CVE-2018-1303 · Apache HTTP Server

    A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this…

    Published 26 Mar 2018 · NVD
  37. Medium 5.9

    CVE-2018-1302 · Apache HTTP Server

    When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.

    Published 26 Mar 2018 · NVD
  38. Medium 5.9

    CVE-2018-1301 · Apache HTTP Server

    A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.

    Published 26 Mar 2018 · NVD
  39. Medium 5.3

    CVE-2018-1283 · Apache HTTP Server

    In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header…

    Published 26 Mar 2018 · NVD
  40. High 8.1

    CVE-2017-15715 · Apache HTTP Server

    In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.

    Published 26 Mar 2018 · NVD
  41. High 7.5

    CVE-2017-15710 · Apache HTTP Server

    In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a…

    Published 26 Mar 2018 · NVD
  42. Critical 9.8

    CVE-2018-8971 · GitLab

    The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users.

    Published 24 Mar 2018 · NVD
  43. Medium 4.3

    CVE-2017-0920 · GitLab

    GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.

    Published 22 Mar 2018 · NVD
  44. High 7.8

    CVE-2018-3710 · GitLab

    Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution.

    Published 21 Mar 2018 · NVD
  45. Medium 6.5

    CVE-2017-0927 · GitLab

    Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.

    Published 21 Mar 2018 · NVD
  46. High 8.8

    CVE-2017-0926 · GitLab

    Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.

    Published 21 Mar 2018 · NVD
  47. High 7.2

    CVE-2017-0925 · GitLab

    Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.

    Published 21 Mar 2018 · NVD
  48. Medium 6.1

    CVE-2017-0924 · GitLab

    Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting.

    Published 21 Mar 2018 · NVD
  49. Medium 6.1

    CVE-2017-0923 · GitLab

    Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.

    Published 21 Mar 2018 · NVD
  50. High 7.5

    CVE-2017-0922 · GitLab

    Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object.

    Published 21 Mar 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.