Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,346
- Published in 7 days
- 287
- Critical in 30 days
- 75
- Actively exploited
- 66
Latest vulnerabilities
11,346 vulnerabilities- Medium 6.5
CVE-2017-10167 · MySQL
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 19 Oct 2017 · NVD - Medium 4.9
CVE-2017-10165 · MySQL
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…
Published 19 Oct 2017 · NVD - High 7.5
CVE-2017-10155 · MySQL
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…
Published 19 Oct 2017 · NVD - Critical 9.8
CVE-2014-9487 · MediaWiki
The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053.
Published 17 Oct 2017 · NVD - Medium 4.7
CVE-2016-9263 · WordPress
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
Published 12 Oct 2017 · NVD - High 7.5
CVE-2015-7384 · Node.js
Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
Published 10 Oct 2017 · NVD - High 7.8
CVE-2014-0047 · Docker Engine
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.
Published 6 Oct 2017 · NVD - High 7.5
CVE-2017-1000254 · curl
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the…
Published 6 Oct 2017 · NVD - Medium 6.5
CVE-2017-1000101 · curl
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could…
Published 5 Oct 2017 · NVD - Medium 6.5
CVE-2017-1000100 · curl
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the…
Published 5 Oct 2017 · NVD - Medium 6.5
CVE-2017-1000099 · curl
When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the…
Published 5 Oct 2017 · NVD - High 8.1Actively exploited
CVE-2017-12617 · Apache Tomcat
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Published 4 Oct 2017 · Fixed in 8.0.47, 8.5.23, 9.0.1 · NVD - Medium 6.5
CVE-2017-14990 · WordPress
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
Published 3 Oct 2017 · NVD - High 7.5
CVE-2017-14849 · Node.js
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Published 28 Sept 2017 · NVD - Critical 9.8
CVE-2015-8707 · Magento / Adobe Commerce
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
Published 26 Sept 2017 · NVD - Medium 6.1
CVE-2017-14726 · WordPress
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
Published 23 Sept 2017 · NVD - Medium 5.4
CVE-2017-14725 · WordPress
Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14724 · WordPress
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
Published 23 Sept 2017 · NVD - Critical 9.8
CVE-2017-14723 · WordPress
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
Published 23 Sept 2017 · NVD - High 7.5
CVE-2017-14722 · WordPress
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14721 · WordPress
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14720 · WordPress
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
Published 23 Sept 2017 · NVD - High 7.5
CVE-2017-14719 · WordPress
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14718 · WordPress
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
Published 23 Sept 2017 · NVD - Critical 9.8
CVE-2017-14596 · Joomla!
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
Published 20 Sept 2017 · NVD - Low 3.7
CVE-2017-14595 · Joomla!
In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.
Published 20 Sept 2017 · NVD - Medium 6.1
CVE-2015-5608 · Joomla!
Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
Published 20 Sept 2017 · NVD - High 7.5
CVE-2015-3890 · OpenLiteSpeed
Use-after-free vulnerability in Open Litespeed before 1.3.10.
Published 20 Sept 2017 · Fixed in 1.3.10 · NVD - Medium 6.5
CVE-2015-2927 · Node.js
node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
Published 20 Sept 2017 · NVD - Medium 6.1
CVE-2014-9758 · Magento / Adobe Commerce
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
Published 20 Sept 2017 · NVD - High 7.5
CVE-2017-14033 · Ruby
The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.
Published 19 Sept 2017 · NVD - High 8.8
CVE-2017-10784 · Ruby
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Published 19 Sept 2017 · NVD - High 7.5
CVE-2017-12616 · Apache Tomcat
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Published 19 Sept 2017 · NVD - High 8.1Actively exploited
CVE-2017-12615 · Apache Tomcat
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Published 19 Sept 2017 · NVD - High 7.5
CVE-2017-9798 · Apache HTTP Server
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a…
Published 18 Sept 2017 · NVD - Critical 9.1
CVE-2017-0898 · Ruby
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
Published 15 Sept 2017 · NVD - High 7.5
CVE-2017-14227 · MongoDB
In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
Published 9 Sept 2017 · NVD - High 7.5
CVE-2014-6438 · Ruby
The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
Published 6 Sept 2017 · NVD - Critical 9.8
CVE-2017-14064 · Ruby
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
Published 31 Aug 2017 · NVD - Medium 5.3
CVE-2017-3735 · OpenSSL
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
Published 28 Aug 2017 · NVD - Medium 5.9
CVE-2014-4616 · Python
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
Published 24 Aug 2017 · Fixed in 3.2.6, 3.3.6, 3.4.1 · NVD - High 7.5
CVE-2017-12934 · PHP
ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zval_get_type function in Zend/zend_types.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Published 18 Aug 2017 · NVD - Critical 9.8
CVE-2017-12933 · PHP
The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Published 18 Aug 2017 · NVD - Critical 9.8
CVE-2017-12932 · PHP
ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Published 18 Aug 2017 · NVD - High 7.5
CVE-2017-7548 · PostgreSQL
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
Published 16 Aug 2017 · Fixed in 9.4.13, 9.5.8, 9.6.4 · NVD - High 8.8
CVE-2017-7547 · PostgreSQL
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
Published 16 Aug 2017 · NVD - Critical 9.8
CVE-2017-7546 · PostgreSQL
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
Published 16 Aug 2017 · NVD - High 8.8
CVE-2017-12426 · GitLab
GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.
Published 14 Aug 2017 · NVD - High 7.5
CVE-2017-7675 · Apache Tomcat
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Published 11 Aug 2017 · NVD - Medium 4.3
CVE-2017-7674 · Apache Tomcat
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
Published 11 Aug 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.