UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,804
Published in 7 days
946
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,804 vulnerabilities
  1. Medium 4.3

    CVE-2019-19263 · GitLab

    GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  2. Medium 4.3

    CVE-2019-19262 · GitLab

    GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.

    Published 3 Jan 2020 · Fixed in 12.5.2 · NVD
  3. High 8.8

    CVE-2019-19261 · GitLab

    GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  4. Medium 5.4

    CVE-2019-19260 · GitLab

    GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  5. Medium 4.3

    CVE-2019-19259 · GitLab

    GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  6. Medium 5.3

    CVE-2019-19258 · GitLab

    GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  7. Medium 5.3

    CVE-2019-19257 · GitLab

    GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  8. Medium 5.3

    CVE-2019-19256 · GitLab

    GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  9. Medium 4.3

    CVE-2019-19255 · GitLab

    GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  10. Medium 5.4

    CVE-2019-19311 · GitLab

    GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.

    Published 3 Jan 2020 · Fixed in 12.3.7, 12.4.4, 12.5.1 · NVD
  11. Medium 5.3

    CVE-2019-19254 · GitLab

    GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  12. Critical 9.8

    CVE-2019-19088 · GitLab

    Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  13. Medium 4.3

    CVE-2019-19087 · GitLab

    Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  14. Medium 4.3

    CVE-2019-19086 · GitLab

    Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  15. Critical 9.8

    CVE-2019-20330 · Oracle WebLogic Server

    FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

    Published 3 Jan 2020 · NVD
  16. Critical 9.8

    CVE-2014-0048 · Docker Engine

    An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.

    Published 2 Jan 2020 · Fixed in 1.5.0 · NVD
  17. Medium 6.1

    CVE-2019-20225 · MyBB

    MyBB before 1.8.22 allows an open redirect on login.

    Published 2 Jan 2020 · Fixed in 1.8.22 · NVD
  18. High 7.5

    CVE-2019-20218 · SQLite

    selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

    Published 2 Jan 2020 · NVD
  19. Medium 4.7

    CVE-2011-3585 · Samba

    Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.

    Published 31 Dec 2019 · NVD
  20. High 8.8

    CVE-2019-20197 · Nagios XI

    In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.

    Published 31 Dec 2019 · NVD
  21. Medium 6.1

    CVE-2019-9554 · Craft CMS

    In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.

    Published 31 Dec 2019 · NVD
  22. High 7.5

    CVE-2019-20176 · Pure-FTPd

    In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.

    Published 31 Dec 2019 · NVD
  23. Medium 4.8

    CVE-2019-12186 · Sylius

    An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to…

    Published 31 Dec 2019 · NVD
  24. High 7.2

    CVE-2019-7479 · SonicWall SonicOS

    A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version 5.9.1.12-4o and earlier, Gen 6 version 6.2.7.4-32n, 6.5.1.4-4n, 6.5.2.3-4n, 6.5.3.3-3n, 6.2.7.10-3n, 6.4.1.0-3n, 6.5.3.3-3n, 6.5.1.9-4n and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS),…

    Published 31 Dec 2019 · NVD
  25. Medium 5.3

    CVE-2018-20507 · GitLab

    An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  26. Medium 6.3

    CVE-2018-20501 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  27. High 7.2

    CVE-2018-20499 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  28. Medium 4.3

    CVE-2018-20498 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  29. Medium 5.0

    CVE-2018-20497 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  30. Medium 5.4

    CVE-2018-20496 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  31. Medium 5.3

    CVE-2018-20495 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  32. High 7.5

    CVE-2018-20494 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  33. Medium 4.3

    CVE-2018-20493 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  34. Medium 5.4

    CVE-2018-20491 · GitLab

    An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  35. Medium 5.4

    CVE-2018-20490 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  36. Medium 5.3

    CVE-2018-20489 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  37. Medium 4.3

    CVE-2018-20488 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  38. High 7.5Actively exploited

    CVE-2019-17558 · Apache Solr

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by…

    Published 30 Dec 2019 · Fixed in 7.7.3, 8.4.0 · NVD
  39. Medium 5.4

    CVE-2019-20139 · Nagios XI

    In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.

    Published 30 Dec 2019 · NVD
  40. Critical 9.8

    CVE-2019-16535 · ClickHouse

    In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.

    Published 30 Dec 2019 · Fixed in 19.14 · NVD
  41. Medium 6.5

    CVE-2019-15024 · ClickHouse

    In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to…

    Published 30 Dec 2019 · Fixed in 19.14.3 · NVD
  42. Medium 4.3

    CVE-2019-20043 · WordPress

    In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous…

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  43. Medium 6.1

    CVE-2019-20042 · WordPress

    In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  44. Critical 9.8

    CVE-2019-20041 · WordPress

    wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  45. High 7.5

    CVE-2012-4420 · Java

    An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

    Published 26 Dec 2019 · NVD
  46. Medium 5.3

    CVE-2018-20492 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6).

    Published 26 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  47. Medium 6.1

    CVE-2019-6025 · Movable Type

    Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type Advanced 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type Advanced 6.3.9 and…

    Published 26 Dec 2019 · NVD
  48. Medium 6.1

    CVE-2018-18288 · CrushFTP

    CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.

    Published 26 Dec 2019 · NVD
  49. High 7.5

    CVE-2019-19925 · SQLite

    zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

    Published 24 Dec 2019 · NVD
  50. High 7.5

    CVE-2019-19956 · libxml2

    xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

    Published 24 Dec 2019 · Fixed in 2.9.10 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.