Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,831
- Published in 7 days
- 973
- Critical in 30 days
- 359
- Actively exploited
- 423
Latest vulnerabilities
39,831 vulnerabilities- Medium 5.3
CVE-2019-11046 · PHP
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Published 23 Dec 2019 · NVD - Medium 5.9
CVE-2019-11045 · PHP
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Published 23 Dec 2019 · NVD - High 7.5
CVE-2019-11044 · PHP
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Published 23 Dec 2019 · NVD - High 7.5
CVE-2019-19926 · SQLite
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
Published 23 Dec 2019 · NVD - Medium 5.4
CVE-2019-16781 · WordPress
Authenticated cross-site scripting (XSS) in WordPress block editor (within dashboard)
Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress - Medium 5.4
CVE-2019-16780 · WordPress
Stored cross-site scripting (XSS) in WordPress block editor
Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress - Medium 6.5
CVE-2019-15584 · GitLab
A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.
Published 20 Dec 2019 · Fixed in 12.1.10, 12.2.6, 12.3.2 · NVD - Critical 9.8
CVE-2019-17571 · Apache Log4j, Oracle WebLogic Server
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Published 20 Dec 2019 · NVD - Critical 9.8
CVE-2019-17440 · Palo Alto Networks PAN-OS
Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series…
Published 20 Dec 2019 · NVD - Critical 9.8
CVE-2019-8256 · Adobe ColdFusion
ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful exploitation could lead to privilege escalation.
Published 19 Dec 2019 · NVD - Medium 6.1
CVE-2019-19910 · MediaWiki
The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impact is XSS) and IMG src=http (impact is disclosing the client's IP address). This can occur within a talk page topical header that is viewed within a mobile (MobileFrontend) context.
Published 19 Dec 2019 · NVD - High 8.1
CVE-2019-11780 · Odoo
Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation.
Published 19 Dec 2019 · NVD - Medium 4.8
CVE-2019-19903 · Backdrop CMS
An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role…
Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD - High 7.2
CVE-2019-19902 · Backdrop CMS
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be…
Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD - Medium 4.8
CVE-2019-19901 · Backdrop CMS
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would…
Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD - Medium 4.8
CVE-2019-19900 · Backdrop CMS
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an editor execute scripting when creating content, aka XSS. This vulnerability is mitigated by the fact that an attacker…
Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD - High 7.8
CVE-2019-7487 · SonicWall SonicOS
Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution.
Published 19 Dec 2019 · NVD - Medium 6.5
CVE-2019-15006 · Confluence
There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the…
Published 19 Dec 2019 · Fixed in 6.15.10, 7.0.5, 7.1.2 · NVD - Medium 4.4
CVE-2019-11109 · F5 BIG-IP
Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow a privileged user to potentially enable denial of service via local access.
Published 18 Dec 2019 · NVD - Medium 5.3
CVE-2019-5487 · GitLab
An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits.
Published 18 Dec 2019 · Fixed in 12.1.13, 12.2.7, 12.3.3 · NVD - High 8.8
CVE-2019-5486 · GitLab
A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements.
Published 18 Dec 2019 · Fixed in 12.1.10, 12.2.6, 12.3.2 · NVD - Medium 6.5
CVE-2019-5469 · GitLab
An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets.
Published 18 Dec 2019 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD - Medium 6.5
CVE-2019-15591 · GitLab
An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
Published 18 Dec 2019 · Fixed in 12.3.3 · NVD - High 8.8
CVE-2019-15589 · GitLab
An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.
Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD - Medium 6.5
CVE-2019-15580 · GitLab
An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.
Published 18 Dec 2019 · Fixed in 12.1.10, 12.2.6, 12.3.2 · NVD - Medium 4.3
CVE-2019-15577 · GitLab
An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.
Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD - High 7.5
CVE-2019-15576 · GitLab
An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.
Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD - High 7.5
CVE-2019-15575 · GitLab
A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.
Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD - Medium 5.4
CVE-2019-7621 · Kibana
Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboard containing the visualization it could execute JavaScript in the victim�s browser.
Published 18 Dec 2019 · Fixed in 6.8.6, 7.5.1 · NVD - High 7.5
CVE-2019-19880 · SQLite
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Published 18 Dec 2019 · NVD - Critical 9.8
CVE-2019-19846 · Joomla!
In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.
Published 18 Dec 2019 · NVD - Medium 5.3
CVE-2019-19845 · Joomla!
In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.
Published 18 Dec 2019 · Fixed in 3.9.14 · NVD - Medium 4.3
CVE-2019-15013 · Jira
The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.
Published 18 Dec 2019 · Fixed in 7.13.12, 8.4.3, 8.5.2 · NVD - High 7.5
CVE-2014-8179 · Docker Engine
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Published 17 Dec 2019 · Fixed in 1.8.3 · NVD - High 7.2
CVE-2019-19850 · TYPO3
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
Published 17 Dec 2019 · Fixed in 8.7.30, 9.5.12, 10.2.2 · NVD - High 8.8
CVE-2019-19849 · TYPO3
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable…
Published 17 Dec 2019 · Fixed in 8.7.30, 9.5.12, 10.2.2 · NVD - High 7.2
CVE-2019-19848 · TYPO3
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
Published 17 Dec 2019 · Fixed in 8.7.30, 9.5.12, 10.2.2 · NVD - Medium 6.5
CVE-2019-15235 · Control Web Panel
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782.
Published 17 Dec 2019 · NVD - Medium 6.5
CVE-2019-14782 · Control Web Panel
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account.
Published 17 Dec 2019 · NVD - Medium 5.5
CVE-2014-8178 · Docker Engine
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
Published 17 Dec 2019 · Fixed in 1.8.3 · NVD - Medium 5.3
CVE-2019-19714 · Contao
Insert tag injection in the login module
Published 17 Dec 2019 · Fixed in 4.8.6 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2019-19712 · Contao
Information disclosure in the back end
Published 17 Dec 2019 · Fixed in 4.4.46 · NVD, Project advisories (GitHub) - High 8.8
CVE-2019-19745 · Contao
Unrestricted file uploads
Published 17 Dec 2019 · Fixed in 4.4.46 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2019-19830 · SPIP
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
Published 17 Dec 2019 · Fixed in 3.2.7 · NVD - Medium 5.3
CVE-2019-12414 · Apache Superset
In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab
Published 16 Dec 2019 · Fixed in 0.32 · NVD - Medium 5.3
CVE-2019-12413 · Apache Superset
In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.
Published 16 Dec 2019 · Fixed in 0.31 · NVD - Medium 6.5
CVE-2014-8561 · ImageMagick
imagemagick 6.8.9.6 has remote DOS via infinite loop
Published 15 Dec 2019 · NVD - Medium 5.3
CVE-2019-19722 · Dovecot
In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.
Published 13 Dec 2019 · Fixed in 2.3.9.2 · NVD - High 7.5
CVE-2019-18838 · Envoy
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An encoder filter that invokes route manager APIs that access a request's Host header causes a NULL…
Published 13 Dec 2019 · NVD - Critical 9.8
CVE-2019-18802 · Envoy
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
Published 13 Dec 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.