Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,771
- Published in 7 days
- 950
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,771 vulnerabilities- High 7.5
CVE-2020-8659 · Envoy
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.
Published 4 Mar 2020 · NVD - Critical 9.8
CVE-2020-9757 · Craft CMS
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
Published 4 Mar 2020 · Fixed in 3.3.0 · NVD - Medium 5.3
CVE-2020-5251 · Parse Server
In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.
Published 4 Mar 2020 · Fixed in 4.1.0 · NVD - Medium 5.5
CVE-2020-10029 · GNU C Library
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
Published 4 Mar 2020 · Fixed in 2.32.0 · NVD - High 7.5
CVE-2018-5951 · MikroTik RouterOS
An issue was discovered in Mikrotik RouterOS. Crafting a packet that has a size of 1 byte and sending it to an IPv6 address of a RouterOS box with IP Protocol 97 will cause RouterOS to reboot imminently. All versions of RouterOS that supports EoIPv6 are vulnerable to this attack.
Published 2 Mar 2020 · NVD - Critical 9.8
CVE-2020-9548 · Oracle WebLogic Server
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Published 2 Mar 2020 · NVD - Critical 9.8
CVE-2020-9547 · Oracle WebLogic Server
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
Published 2 Mar 2020 · NVD - Critical 9.8
CVE-2020-9546 · Oracle WebLogic Server
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
Published 2 Mar 2020 · NVD - High 7.5
CVE-2020-5247 · Ruby
In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response…
Published 28 Feb 2020 · NVD - Medium 5.3
CVE-2020-7063 · PHP
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is…
Published 27 Feb 2020 · NVD - High 7.5
CVE-2020-7062 · PHP
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
Published 27 Feb 2020 · NVD - Critical 9.1
CVE-2020-7061 · PHP
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.
Published 27 Feb 2020 · NVD - Medium 6.1
CVE-2015-2992 · Apache Struts
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
Published 27 Feb 2020 · Fixed in 2.3.20 · NVD - High 7.8
CVE-2020-3167 · Cisco ASA and Firepower Threat Defense
A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS). The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted arguments to specific commands. A successful exploit could allow the…
Published 26 Feb 2020 · Fixed in 9.9.2.66, 9.12.3.6, 9.13.1.5 · NVD - Medium 6.7
CVE-2020-3166 · Cisco ASA and Firepower Threat Defense
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system (OS). The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted arguments to a specific CLI command. A successful exploit could allow the attacker to read or write to…
Published 26 Feb 2020 · Fixed in 9.9.2.66, 9.13.1.5 · NVD - High 7.5
CVE-2020-9274 · Pure-FTPd
An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.
Published 26 Feb 2020 · Fixed in 1.0.50 · NVD - Medium 5.4
CVE-2020-20406 · Elementor
Elementor Website Builder – more than just a page builder: Cross-site Scripting
Published 26 Feb 2020 · Fixed in 2.9.3 · WPVulnerability - Critical 9.8
CVE-2020-9398 · ISPConfig
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
Published 25 Feb 2020 · Fixed in 3.1.15 · NVD - High 8.1
CVE-2020-8818 · Magento / Adobe Commerce
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback…
Published 25 Feb 2020 · NVD - Critical 9.8Actively exploited
CVE-2020-1938 · Apache Tomcat
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99,…
Published 24 Feb 2020 · Fixed in 7.0.100, 8.5.51, 9.0.31 · NVD - Medium 4.8
CVE-2020-1935 · Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a…
Published 24 Feb 2020 · NVD - Medium 4.8
CVE-2019-17569 · Apache Tomcat
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular…
Published 24 Feb 2020 · NVD - High 7.5
CVE-2012-0785 · Jenkins
Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."
Published 24 Feb 2020 · Fixed in 1.424.2, 1.447 · NVD - High 7.5
CVE-2020-9365 · Pure-FTPd
An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.
Published 24 Feb 2020 · NVD - Medium 6.5
CVE-2020-5188 · DNN Platform
DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.
Published 24 Feb 2020 · NVD - High 8.8
CVE-2020-5187 · DNN Platform
DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).
Published 24 Feb 2020 · NVD - Medium 5.4
CVE-2020-5186 · DNN Platform
DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).
Published 24 Feb 2020 · NVD - Medium 5.9
CVE-2020-9329 · Gogs
Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition.
Published 21 Feb 2020 · NVD - High 7.5
CVE-2020-9327 · SQLite
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
Published 21 Feb 2020 · NVD - Medium 5.9
CVE-2013-3587 · F5 BIG-IP
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP…
Published 21 Feb 2020 · NVD - Critical 9.8
CVE-2016-4606 · curl
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Published 21 Feb 2020 · Fixed in 7.49.1 · NVD - Critical 9.8
CVE-2014-4650 · Python
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Published 20 Feb 2020 · Fixed in 3.2.6, 3.3.6, 3.4.2 · NVD - High 8.8
CVE-2020-9273 · ProFTPD
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
Published 20 Feb 2020 · NVD - High 7.5
CVE-2020-9272 · ProFTPD
ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function.
Published 20 Feb 2020 · Fixed in 1.3.6c · NVD - High 8.8
CVE-2019-12437 · Silverstripe CMS
In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,
Published 19 Feb 2020 · NVD - Medium 4.3
CVE-2019-12246 · Silverstripe CMS
SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.
Published 19 Feb 2020 · NVD - Critical 9.8
CVE-2014-3622 · PHP
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.
Published 19 Feb 2020 · Fixed in 5.6.1 · NVD - Medium 5.3
CVE-2020-8633 · Zimbra Collaboration
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.
Published 18 Feb 2020 · Fixed in 8.8.15 · NVD - Critical 9.8Actively exploited
CVE-2020-7796 · Zimbra Collaboration
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
Published 18 Feb 2020 · Fixed in 8.8.15 · NVD - Critical 9.8
CVE-2013-6295 · PrestaShop
PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module
Published 18 Feb 2020 · NVD - Medium 5.4
CVE-2020-10385 · WPForms Lite
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting
Published 18 Feb 2020 · Fixed in 1.5.9 · WPVulnerability - High 7.8
CVE-2014-1947 · ImageMagick
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.
Published 17 Feb 2020 · NVD - Medium 6.1
CVE-2019-19325 · Silverstripe CMS
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials…
Published 17 Feb 2020 · Fixed in 4.4.5, 4.5.2 · NVD - Medium 6.5
CVE-2020-1692 · Moodle
Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.
Published 17 Feb 2020 · Fixed in 3.7.2 · NVD - Critical 9.8
CVE-2013-3738 · Zabbix
A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary code.
Published 17 Feb 2020 · NVD - High 7.5
CVE-2020-8795 · GitLab
In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
Published 17 Feb 2020 · NVD - Medium 4.3
CVE-2019-12825 · GitLab
Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no…
Published 17 Feb 2020 · Fixed in 12.5.0 · NVD - Medium 5.4
CVE-2020-9016 · Dolibarr ERP CRM
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
Published 16 Feb 2020 · NVD - Medium 4.3
CVE-2019-15594 · GitLab
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
Published 14 Feb 2020 · NVD - Medium 4.3
CVE-2019-15592 · GitLab
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
Published 14 Feb 2020 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.