Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,771
- Published in 7 days
- 957
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,771 vulnerabilities- Medium 6.1
CVE-2020-10078 · GitLab
GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.
Published 13 Mar 2020 · NVD - Medium 6.5
CVE-2019-16157 · Fortinet FortiWeb
An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via diagnose debug commands.
Published 13 Mar 2020 · NVD - Medium 5.3
CVE-2020-10535 · GitLab
GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address.
Published 12 Mar 2020 · Fixed in 12.8.6 · NVD - Critical 9.8
CVE-2020-10534 · MediaWiki
In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges. This is related to the case in which an IP address is contained in two ranges, one of which is locally disabled.
Published 12 Mar 2020 · NVD - Medium 6.1
CVE-2019-16156 · Fortinet FortiWeb
An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthenticated attacker to perform a Cross Site Scripting attack (XSS).
Published 12 Mar 2020 · NVD - High 8.8
CVE-2020-10531 · Node.js
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
Published 12 Mar 2020 · Fixed in 10.21.0 · NVD - Medium 5.4
CVE-2020-0903 · Microsoft Exchange Server
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
Published 12 Mar 2020 · NVD - High 7.8
CVE-2020-1981 · Palo Alto Networks PAN-OS
A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtual appliance. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or…
Published 11 Mar 2020 · Fixed in 8.1.13 · NVD - High 7.8
CVE-2020-1980 · Palo Alto Networks PAN-OS
A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions. This issue is fixed in PAN-OS 8.1.13, and all later versions.
Published 11 Mar 2020 · Fixed in 8.1.13 · NVD - High 7.8
CVE-2020-1979 · Palo Alto Networks PAN-OS
A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama. This issue does not affect…
Published 11 Mar 2020 · Fixed in 8.1.13 · NVD - High 7.5
CVE-2013-1753 · Python
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.
Published 11 Mar 2020 · Fixed in 3.2.6, 3.3.6, 3.4.3 · NVD - Medium 4.3
CVE-2019-16107 · phpBB
Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.
Published 11 Mar 2020 · NVD - High 7.7
CVE-2020-5258 · MySQL, Oracle WebLogic Server
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This…
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-13121 · GitLab
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13011 · GitLab
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity.
Published 10 Mar 2020 · NVD - Medium 5.9
CVE-2019-13010 · GitLab
An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. It allows Uncontrolled Resource Consumption.
Published 10 Mar 2020 · NVD - Medium 6.5
CVE-2019-13009 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.9
CVE-2019-13007 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13006 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13005 · GitLab
An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 5.3
CVE-2019-13004 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments section would become inaccessible. It has Incorrect Access Control (issue 1 of 2).
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-13003 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption.
Published 10 Mar 2020 · Fixed in 12.0.3 · NVD - Medium 4.3
CVE-2019-13002 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-13001 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. It allows authentication bypass.
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-12446 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.
Published 10 Mar 2020 · NVD - Medium 5.4
CVE-2019-12445 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS.
Published 10 Mar 2020 · NVD - Medium 6.1
CVE-2019-12444 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.
Published 10 Mar 2020 · NVD - Critical 9.8
CVE-2019-12443 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks.
Published 10 Mar 2020 · NVD - Medium 6.1
CVE-2019-12442 · GitLab
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics.
Published 10 Mar 2020 · NVD - High 7.5
CVE-2019-12441 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-12434 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
Published 10 Mar 2020 · NVD - Medium 5.3
CVE-2019-12433 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-12432 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. It allows Information Disclosure.
Published 10 Mar 2020 · NVD - Medium 4.3
CVE-2019-12431 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through the Search API. It has Improper Access Control.
Published 10 Mar 2020 · NVD - High 8.8
CVE-2019-12430 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. It allows Command Injection.
Published 10 Mar 2020 · NVD - Medium 6.5
CVE-2019-12429 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request counts of confidential issues via the milestone details page. It has Improper Access Control.
Published 10 Mar 2020 · NVD - Critical 9.8
CVE-2019-12428 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization.
Published 10 Mar 2020 · NVD - Medium 5.5
CVE-2020-10251 · ImageMagick
In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\heic.c. It can be triggered via an image with a width or height value that exceeds the actual size of the image.
Published 10 Mar 2020 · NVD - Medium 5.5
CVE-2020-10237 · Froxlor
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
Published 9 Mar 2020 · NVD - Medium 6.1
CVE-2020-10236 · Froxlor
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
Published 9 Mar 2020 · Fixed in 0.10.14 · NVD - High 8.8
CVE-2020-10235 · Froxlor
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
Published 9 Mar 2020 · Fixed in 0.10.14 · NVD - High 7.8
CVE-2020-9470 · Wing FTP Server
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the…
Published 7 Mar 2020 · NVD - Medium 6.1
CVE-2020-9281 · Drupal
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Published 7 Mar 2020 · Fixed in 8.7.12, 8.8.4 · NVD - High 7.8
CVE-2020-8635 · Wing FTP Server
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.
Published 7 Mar 2020 · NVD - High 7.8
CVE-2020-8634 · Wing FTP Server
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root.
Published 7 Mar 2020 · NVD - Critical 9.8
CVE-2020-8113 · GitLab
GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
Published 6 Mar 2020 · Fixed in 12.6.8 · NVD - Medium 6.3
CVE-2020-5250 · PrestaShop
Possible information steal
Published 5 Mar 2020 · Fixed in 1.7.6.4 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2020-8660 · Envoy
CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.
Published 4 Mar 2020 · Fixed in 1.12.3, 1.13.1 · NVD - Medium 5.3
CVE-2020-8664 · Envoy
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
Published 4 Mar 2020 · NVD - High 7.5
CVE-2020-8661 · Envoy
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
Published 4 Mar 2020 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.