Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,331
- Published in 7 days
- 274
- Critical in 30 days
- 73
- Actively exploited
- 66
Latest vulnerabilities
11,331 vulnerabilities- Critical 9.1
CVE-2017-15896 · Node.js
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.
Published 11 Dec 2017 · Fixed in 6.12.2, 8.9.3, 9.2.1 · NVD - Medium 5.9
CVE-2017-3738 · Node.js, OpenSSL
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce…
Published 7 Dec 2017 · Fixed in 6.12.2, 8.9.3, 9.2.1 · NVD - Medium 5.9
CVE-2017-3737 · OpenSSL
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a…
Published 7 Dec 2017 · NVD - Medium 5.4
CVE-2017-17094 · WordPress
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
Published 2 Dec 2017 · Fixed in 4.9.1 · NVD - Medium 5.4
CVE-2017-17093 · WordPress
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
Published 2 Dec 2017 · Fixed in 4.9.1 · NVD - Medium 5.4
CVE-2017-17092 · WordPress
wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.
Published 2 Dec 2017 · Fixed in 4.9.1 · NVD - High 8.8
CVE-2017-17091 · WordPress
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.
Published 2 Dec 2017 · NVD - Unrated
WPV-eb935a36f3ce · Elementor
Vulnerability in Elementor Website Builder – more than just a page builder
Published 2 Dec 2017 · Fixed in 1.8.0 · WPVulnerability - Unrated
WPV-5d36808e7f71 · Elementor
Vulnerability in Elementor Website Builder – more than just a page builder
Published 2 Dec 2017 · Fixed in 1.8.8 · WPVulnerability - Critical 9.8
CVE-2017-8818 · curl
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.
Published 29 Nov 2017 · NVD - Critical 9.8
CVE-2017-8817 · curl
The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.
Published 29 Nov 2017 · NVD - Critical 9.8
CVE-2017-8816 · curl
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
Published 29 Nov 2017 · NVD - High 7.5
CVE-2017-17058 · WooCommerce
WooCommerce: Path Traversal
Published 29 Nov 2017 · Fixed in 4.0 · WPVulnerability - High 8.8
CVE-2017-18596 · Elementor
Elementor Website Builder – more than just a page builder: Improper Privilege Management
Published 27 Nov 2017 · Fixed in 1.8.0 · WPVulnerability - Medium 6.7
CVE-2017-12172 · PostgreSQL
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many…
Published 22 Nov 2017 · NVD - Medium 6.5
CVE-2017-15099 · PostgreSQL
INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.
Published 22 Nov 2017 · NVD - High 8.1
CVE-2017-15098 · PostgreSQL
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.
Published 22 Nov 2017 · NVD - Unrated
WPV-d2188ae68dcd · Yoast SEO
Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Published 20 Nov 2017 · Fixed in 5.8.0 · WPVulnerability - Critical 9.8
CVE-2017-1000158 · Python
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
Published 17 Nov 2017 · Fixed in 2.7.15, 3.4.8, 3.5.5 · NVD - High 8.1
CVE-2017-16871 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Code Injection
Published 17 Nov 2017 · NVD, WPVulnerability - High 8.1
CVE-2017-16870 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Server-Side Request Forgery (SSRF)
Published 17 Nov 2017 · NVD, WPVulnerability - High 8.8
CVE-2017-18356 · WooCommerce
WooCommerce: Code Injection
Published 16 Nov 2017 · Fixed in 3.2.4 · NVD, WPVulnerability - Medium 4.8
CVE-2017-16842 · Yoast SEO
Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting
Published 16 Nov 2017 · Fixed in 5.8.0 · WPVulnerability - High 7.5
CVE-2017-8815 · MediaWiki
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
Published 15 Nov 2017 · NVD - High 7.5
CVE-2017-8814 · MediaWiki
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
Published 15 Nov 2017 · NVD - Medium 5.3
CVE-2017-8812 · MediaWiki
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline.
Published 15 Nov 2017 · NVD - Medium 6.1
CVE-2017-8811 · MediaWiki
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.
Published 15 Nov 2017 · NVD - High 7.5
CVE-2017-8810 · MediaWiki
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
Published 15 Nov 2017 · NVD - Critical 9.8
CVE-2017-8809 · MediaWiki
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.
Published 15 Nov 2017 · NVD - Medium 6.1
CVE-2017-8808 · MediaWiki
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping.
Published 15 Nov 2017 · NVD - High 7.5
CVE-2017-8700 · .NET
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".
Published 15 Nov 2017 · NVD - High 8.8
CVE-2017-11879 · .NET
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Published 15 Nov 2017 · NVD - High 7.5
CVE-2016-8610 · OpenSSL
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Published 13 Nov 2017 · NVD - Critical 9.8
CVE-2017-16634 · Joomla!
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.
Published 10 Nov 2017 · NVD - Medium 4.3
CVE-2017-16633 · Joomla!
In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.
Published 10 Nov 2017 · NVD - High 7.5
CVE-2017-16642 · PHP
In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than…
Published 7 Nov 2017 · Fixed in 5.6.32, 7.0.25, 7.1.11 · NVD - Medium 5.9
CVE-2017-16539 · Docker Engine
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
Published 4 Nov 2017 · NVD - Medium 6.5
CVE-2017-3736 · OpenSSL
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work…
Published 2 Nov 2017 · Fixed in 1.0.2m, 1.1.0g · NVD - Critical 9.8
CVE-2017-16510 · WordPress
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.
Published 2 Nov 2017 · NVD - Medium 6.5
CVE-2017-14992 · Docker Engine
Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.
Published 1 Nov 2017 · NVD - Critical 9.1
CVE-2017-15535 · MongoDB
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.
Published 1 Nov 2017 · Fixed in 3.4.10 · NVD - Critical 9.1
CVE-2017-1000257 · curl
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a…
Published 31 Oct 2017 · NVD - High 7.5
CVE-2017-14919 · Node.js
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
Published 30 Oct 2017 · NVD - High 7.8
CVE-2017-15945 · MariaDB
The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to the mysql account for creation of a link.
Published 27 Oct 2017 · Fixed in 10.0.30 · NVD - Medium 6.1
CVE-2012-4378 · MediaWiki
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.
Published 26 Oct 2017 · NVD - Medium 6.1
CVE-2012-4377 · MediaWiki
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.
Published 26 Oct 2017 · NVD - Medium 5.3
CVE-2017-15906 · OpenSSH
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
Published 26 Oct 2017 · Fixed in 7.6 · NVD - High 7.5
CVE-2014-3744 · Node.js
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
Published 23 Oct 2017 · NVD - Medium 4.9
CVE-2012-4382 · MediaWiki
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.
Published 19 Oct 2017 · NVD - High 7.5
CVE-2012-4380 · MediaWiki
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
Published 19 Oct 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.