UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,804
Published in 7 days
946
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,804 vulnerabilities
  1. Medium 6.1

    CVE-2019-16467 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 15 Jan 2020 · NVD
  2. Medium 6.1

    CVE-2019-16466 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 15 Jan 2020 · Fixed in 6.3.3.7, 6.4.7.0, 6.5.3.0 · NVD
  3. High 8.8

    CVE-2015-6497 · Magento / Adobe Commerce

    The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.

    Published 15 Jan 2020 · Fixed in 1.9.2.1, 1.14.2.1 · NVD
  4. Medium 5.3

    CVE-2011-4907 · Joomla!

    Joomla! 1.5x through 1.5.12: Missing JEXEC Check

    Published 15 Jan 2020 · NVD
  5. High 7.5

    CVE-2012-1563 · Joomla!

    Joomla! before 2.5.3 allows Admin Account Creation.

    Published 15 Jan 2020 · Fixed in 2.5.3 · NVD
  6. High 7.5

    CVE-2012-1562 · Joomla!

    Joomla! core before 2.5.3 allows unauthorized password change.

    Published 15 Jan 2020 · Fixed in 2.5.3 · NVD
  7. Medium 6.5

    CVE-2020-5502 · phpBB

    phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

    Published 15 Jan 2020 · NVD
  8. Medium 4.3

    CVE-2020-5501 · phpBB

    phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.

    Published 15 Jan 2020 · NVD
  9. High 8.8

    CVE-2020-0603 · .NET

    A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.

    Published 14 Jan 2020 · NVD
  10. High 7.5

    CVE-2020-0602 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

    Published 14 Jan 2020 · NVD
  11. Critical 9.8

    CVE-2011-2715 · Drupal

    An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.

    Published 14 Jan 2020 · NVD
  12. Medium 6.1

    CVE-2011-2714 · Drupal

    A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.

    Published 14 Jan 2020 · NVD
  13. Medium 6.1

    CVE-2011-3183 · Concrete CMS

    A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.

    Published 14 Jan 2020 · NVD
  14. Low 3.7

    CVE-2019-3981 · MikroTik RouterOS

    MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed password.

    Published 14 Jan 2020 · Fixed in 6.43 · NVD
  15. Medium 5.4

    CVE-2020-5853 · F5 BIG-IP

    In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict.

    Published 14 Jan 2020 · NVD
  16. High 7.5

    CVE-2020-5852 · F5 BIG-IP

    Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). This vulnerability affects TMM through a virtual server configured with a FastL4 profile. Traffic processing is disrupted while TMM restarts. This issue only impacts specific engineering hotfixes. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or…

    Published 14 Jan 2020 · NVD
  17. Medium 4.8

    CVE-2019-12398 · Apache Airflow

    In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

    Published 14 Jan 2020 · Fixed in 1.10.5 · NVD
  18. Medium 5.5

    CVE-2015-2326 · MariaDB, PHP

    The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

    Published 14 Jan 2020 · Fixed in 5.5.26, 5.6.9, 10.0.18 · NVD
  19. High 7.8

    CVE-2015-2325 · MariaDB, PHP

    The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

    Published 14 Jan 2020 · Fixed in 5.5.26, 5.6.9, 10.0.18 · NVD
  20. Medium 4.6

    CVE-2020-5851 · F5 BIG-IP

    On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as…

    Published 14 Jan 2020 · NVD
  21. High 8.8

    CVE-2014-4610 · FFmpeg

    Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.

    Published 14 Jan 2020 · Fixed in 2.0.5, 2.1.5, 2.2.4 · NVD
  22. High 7.5

    CVE-2019-12399 · Apache Kafka

    When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task…

    Published 14 Jan 2020 · NVD
  23. Medium 4.3

    CVE-2019-20144 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  24. Medium 5.3

    CVE-2019-20143 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  25. Medium 4.3

    CVE-2019-20142 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service.

    Published 13 Jan 2020 · NVD
  26. Medium 5.3

    CVE-2020-6832 · GitLab

    An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects.

    Published 13 Jan 2020 · NVD
  27. Medium 4.3

    CVE-2020-5197 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  28. Medium 5.3

    CVE-2019-20148 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  29. Medium 5.3

    CVE-2019-20147 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  30. Medium 5.3

    CVE-2019-20146 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.

    Published 13 Jan 2020 · NVD
  31. Medium 4.3

    CVE-2019-20145 · GitLab

    An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control.

    Published 13 Jan 2020 · NVD
  32. High 7.5

    CVE-2012-4030 · Chamilo LMS

    Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.

    Published 10 Jan 2020 · Fixed in 1.8.8.6 · NVD
  33. High 8.8

    CVE-2020-5504 · phpMyAdmin

    In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

    Published 9 Jan 2020 · Fixed in 4.9.4, 5.0.1 · NVD
  34. Medium 5.3

    CVE-2019-20372 · nginx

    NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

    Published 9 Jan 2020 · Fixed in 1.17.7 · NVD
  35. Medium 6.1

    CVE-2020-6632 · PrestaShop

    In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js.

    Published 9 Jan 2020 · NVD
  36. Low

    CVE-2019-16788 · WordPress

    Users without "publish_posts" rights can mark sticky/unsticky a post via REST API

    Published 8 Jan 2020 · WordPress
  37. High

    CVE-2019-16773 · WordPress

    Stored cross-site scripting (XSS) through 'wp_targeted_link_rel'

    Published 8 Jan 2020 · WordPress
  38. Medium 6.1

    CVE-2020-6163 · MediaWiki

    The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templates/search/PropertySuggestionsWidget.mustache+dom file).

    Published 8 Jan 2020 · NVD
  39. Medium 5.3

    CVE-2014-5209 · F5 BIG-IP

    An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.

    Published 8 Jan 2020 · NVD
  40. Medium 5.4

    CVE-2019-14879 · Moodle

    A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).

    Published 7 Jan 2020 · NVD
  41. Critical 9.8

    CVE-2020-5519 · OpenLiteSpeed

    The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.

    Published 6 Jan 2020 · Fixed in 1.6.5 · NVD
  42. High 7.5

    CVE-2019-19629 · GitLab

    In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration.

    Published 5 Jan 2020 · NVD
  43. Critical 9.8

    CVE-2019-19628 · GitLab

    In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.

    Published 5 Jan 2020 · NVD
  44. High 7.5

    CVE-2019-19314 · GitLab

    GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext.

    Published 5 Jan 2020 · Fixed in 12.3.8, 12.4.5, 12.5.2 · NVD
  45. High 7.5

    CVE-2019-19313 · GitLab

    GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits.

    Published 5 Jan 2020 · Fixed in 12.3.8, 12.4.5, 12.5.2 · NVD
  46. Medium 5.8

    CVE-2019-19312 · GitLab

    GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API.

    Published 5 Jan 2020 · Fixed in 12.3.8, 12.4.5, 12.5.2 · NVD
  47. Medium 6.1

    CVE-2015-9540 · Chamilo LMS

    Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503.

    Published 4 Jan 2020 · NVD
  48. High 7.5

    CVE-2019-19959 · SQLite

    ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.

    Published 3 Jan 2020 · NVD
  49. Medium 4.9

    CVE-2019-19310 · GitLab

    GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  50. Medium 4.3

    CVE-2019-19309 · GitLab

    GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.