Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,832
- Published in 7 days
- 973
- Critical in 30 days
- 359
- Actively exploited
- 423
Latest vulnerabilities
39,832 vulnerabilities- Critical 9.8
CVE-2019-18802 · Envoy
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
Published 13 Dec 2019 · NVD - Critical 9.8
CVE-2019-18801 · Envoy
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used to bypass Envoy's access control mechanisms such as path based routing. An attacker can also modify requests from other…
Published 13 Dec 2019 · NVD - Critical 9.8
CVE-2013-5743 · Zabbix
Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.
Published 11 Dec 2019 · NVD - Medium 6.1
CVE-2013-4303 · MediaWiki
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.
Published 11 Dec 2019 · Fixed in 1.19.8, 1.20.7, 1.21.2 · NVD - High 7.5
CVE-2019-19583 · Xen
An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for #DB interception. The VMX VMEntry checks do not like the exact combination of state which occurs when #DB in…
Published 11 Dec 2019 · NVD - Medium 6.5
CVE-2019-19582 · Xen
An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size…
Published 11 Dec 2019 · NVD - Medium 6.5
CVE-2019-19581 · Xen
An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On 32-bit Arm accesses to bitmaps with bit a…
Published 11 Dec 2019 · NVD - Medium 6.6
CVE-2019-19580 · Xen
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. A malicious…
Published 11 Dec 2019 · NVD - High 8.8
CVE-2019-19578 · Xen
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable of the same or higher level. Xen has limited support for linear pagetables: A page may…
Published 11 Dec 2019 · NVD - High 7.2
CVE-2019-19577 · Xen
An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access during pagetable-height updates. When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number of levels of pagetables (the pagetable height) in the IOMMU according to the guest's address space…
Published 11 Dec 2019 · NVD - Medium 6.1
CVE-2019-19709 · MediaWiki
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.
Published 11 Dec 2019 · NVD - Medium 5.4
CVE-2019-14870 · Samba
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented…
Published 10 Dec 2019 · Fixed in 4.9.17, 4.10.11, 4.11.3 · NVD - Medium 5.3
CVE-2019-14861 · Samba
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for…
Published 10 Dec 2019 · Fixed in 4.9.17, 4.10.11, 4.11.3 · NVD - Medium 6.1
CVE-2016-1000107 · Erlang/OTP
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Published 10 Dec 2019 · NVD - Medium 5.4
CVE-2019-4663 · IBM WebSphere Application Server
IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245.
Published 10 Dec 2019 · Fixed in 19.0.0.11 · NVD - Critical 9.8
CVE-2019-19646 · SQLite
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
Published 9 Dec 2019 · NVD - High 7.5
CVE-2019-19603 · SQLite
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
Published 9 Dec 2019 · NVD - Medium 5.5
CVE-2019-19645 · SQLite
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
Published 9 Dec 2019 · NVD - Medium 5.3
CVE-2019-1551 · OpenSSL
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the…
Published 6 Dec 2019 · NVD - Critical 9.8Actively exploited
CVE-2019-5544 · VMware ESXi
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
Published 6 Dec 2019 · NVD - Critical 9.8
CVE-2019-19617 · phpMyAdmin
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
Published 6 Dec 2019 · Fixed in 4.9.2 · NVD - High 8.8
CVE-2012-1592 · Apache Struts
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
Published 5 Dec 2019 · NVD - High 7.2
CVE-2019-19609 · Strapi
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Published 5 Dec 2019 · NVD - Medium 4.3
CVE-2019-16768 · Sylius
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user…
Published 5 Dec 2019 · Fixed in 1.4.10, 1.5.7, 1.6.3 · NVD - Critical 9.8
CVE-2019-19595 · PrestaShop
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.
Published 5 Dec 2019 · NVD - Critical 9.8
CVE-2019-19594 · PrestaShop
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.
Published 5 Dec 2019 · NVD - Low 2.6
CVE-2018-1002102 · Kubernetes
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
Published 5 Dec 2019 · NVD - High 7.8
CVE-2019-17437 · Palo Alto Networks PAN-OS
An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9.0 versions prior to 9.0.5. PAN-OS version 7.0 and prior EOL versions have not been evaluated for this…
Published 5 Dec 2019 · Fixed in 8.0.20, 8.1.11, 9.0.5 · NVD - Critical 9.8
CVE-2019-19317 · SQLite
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Published 5 Dec 2019 · NVD - Medium 6.8
CVE-2019-19579 · Xen
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is…
Published 4 Dec 2019 · NVD - High 7.2
CVE-2019-19029 · Harbor
SQL Injection via user-groups (CVE-2019-19029)
Published 3 Dec 2019 · Fixed in 1.8.6, 1.9.3 · NVD, Project advisories (GitHub) - Medium 4.9
CVE-2019-19026 · Harbor
SQL Injection via project quotas (CVE-2019-19026)
Published 3 Dec 2019 · Fixed in 1.8.6, 1.9.3 · NVD, Project advisories (GitHub) - High 8.8
CVE-2019-19025 · Harbor
Missing CSRF protection (CVE-2019-19025)
Published 3 Dec 2019 · Fixed in 1.8.6, 1.9.3 · NVD, Project advisories (GitHub) - Medium 4.3
CVE-2019-3990 · Harbor
User Enumeration Vulnerability (CVE-2019-3990)
Published 3 Dec 2019 · NVD, Project advisories (GitHub) - High 8.8
CVE-2019-19023 · Harbor
Privilege Escalation
Published 3 Dec 2019 · Fixed in 1.8.6, 1.9.3 · NVD, Project advisories (GitHub) - High 8.6
CVE-2014-9356 · Docker Engine
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
Published 2 Dec 2019 · Fixed in 1.3.3 · NVD - Medium 4.9
CVE-2019-19269 · ProFTPD
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.
Published 30 Nov 2019 · NVD - High 7.5
CVE-2013-7484 · Zabbix
Zabbix before 5.0 represents passwords in the users table with unsalted MD5.
Published 30 Nov 2019 · NVD - Medium 5.9
CVE-2015-1855 · Ruby
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
Published 29 Nov 2019 · Fixed in 2.1.6, 2.2.2 · NVD - High 7.5
CVE-2019-6673 · F5 BIG-IP
On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel (TMM).
Published 27 Nov 2019 · NVD - High 7.5
CVE-2019-6671 · F5 BIG-IP
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, leading to resource starvation.
Published 27 Nov 2019 · NVD - Medium 4.4
CVE-2019-6670 · F5 BIG-IP
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly exposing the plaintext unit key for their vCMP guests on the filesystem.
Published 27 Nov 2019 · NVD - High 7.5
CVE-2019-6669 · F5 BIG-IP
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cause TMM to restart under some circumstances.
Published 27 Nov 2019 · NVD - Medium 5.5
CVE-2019-6668 · F5 BIG-IP
The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5 may allow unprivileged users to access files owned by root.
Published 27 Nov 2019 · NVD - High 7.5
CVE-2019-6667 · F5 BIG-IP
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume excessive resources when processing traffic for a Virtual Server with the FIX (Financial Information eXchange) profile applied.
Published 27 Nov 2019 · NVD - High 7.5
CVE-2019-6666 · F5 BIG-IP
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream server or cache sends the BIG-IP an invalid age header value.
Published 27 Nov 2019 · NVD - High 7.5
CVE-2019-15705 · Fortinet FortiOS
An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote attacker to crash the SSL VPN service by sending a crafted POST request.
Published 27 Nov 2019 · NVD - Critical 9.8
CVE-2011-2523 · vsftpd
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
Published 27 Nov 2019 · NVD - Medium 5.9
CVE-2019-19242 · SQLite
SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
Published 27 Nov 2019 · NVD - Medium 6.1
CVE-2016-1000110 · Python
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.
Published 27 Nov 2019 · Fixed in 3.3.7, 3.4.6, 3.5.3 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.