Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,832
- Published in 7 days
- 973
- Critical in 30 days
- 359
- Actively exploited
- 423
Latest vulnerabilities
39,832 vulnerabilities- Critical 9.8
CVE-2019-19330 · HAProxy
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Published 27 Nov 2019 · Fixed in 2.0.10 · NVD - High 7.8
CVE-2019-14812 · Ghostscript
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Published 27 Nov 2019 · Fixed in 9.50 · NVD - High 7.8
CVE-2019-10216 · Ghostscript
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
Published 27 Nov 2019 · Fixed in 9.50 · NVD - Critical 9.8
CVE-2011-1939 · PHP
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
Published 26 Nov 2019 · Fixed in 5.3.6 · NVD - High 8.1
CVE-2019-16255 · Ruby
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
Published 26 Nov 2019 · NVD - Medium 5.3
CVE-2019-16254 · Ruby
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF…
Published 26 Nov 2019 · NVD - High 7.5
CVE-2019-16201 · Ruby
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
Published 26 Nov 2019 · NVD - High 7.5
CVE-2019-18679 · Squid
An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code…
Published 26 Nov 2019 · NVD - Medium 5.3
CVE-2019-18678 · Squid
An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and…
Published 26 Nov 2019 · NVD - Medium 6.1
CVE-2019-18677 · Squid
An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.
Published 26 Nov 2019 · NVD - High 7.5
CVE-2019-18676 · Squid
An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme.
Published 26 Nov 2019 · NVD - Medium 5.3
CVE-2019-18456 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions (issue 1 of 4).
Published 26 Nov 2019 · NVD - High 7.5
CVE-2019-18455 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop.
Published 26 Nov 2019 · NVD - Medium 6.1
CVE-2019-18454 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18453 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions.
Published 26 Nov 2019 · NVD - Medium 5.3
CVE-2019-18452 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions.
Published 26 Nov 2019 · NVD - Medium 6.1
CVE-2019-18451 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect.
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18450 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions.
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18449 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2).
Published 26 Nov 2019 · NVD - Medium 6.5
CVE-2019-18448 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18447 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18446 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).
Published 26 Nov 2019 · NVD - Medium 6.5
CVE-2019-15845 · Ruby
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
Published 26 Nov 2019 · NVD - Critical 9.8
CVE-2019-12526 · Squid
An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.
Published 26 Nov 2019 · NVD - Critical 9.1
CVE-2019-12523 · Squid
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.
Published 26 Nov 2019 · NVD - High 7.5
CVE-2019-6477 · BIND 9
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server…
Published 26 Nov 2019 · NVD - Medium 5.3
CVE-2019-18459 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of 4).
Published 26 Nov 2019 · NVD - Low 2.7
CVE-2019-18458 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4).
Published 26 Nov 2019 · NVD - High 8.8
CVE-2019-18457 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions.
Published 26 Nov 2019 · NVD - Critical 9.8
CVE-2019-6675 · F5 BIG-IP
BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerability which allows an authentication bypass. This can result in a complete compromise of the system. This issue only impacts specific engineering hotfixes using the aforementioned authentication configuration. NOTE: This vulnerability does…
Published 26 Nov 2019 · NVD - Medium 5.4
CVE-2019-19206 · Dolibarr ERP CRM
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18463 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4).
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18462 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions.
Published 26 Nov 2019 · NVD - Medium 4.3
CVE-2019-18461 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control.
Published 26 Nov 2019 · NVD - High 7.5
CVE-2019-18460 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control.
Published 26 Nov 2019 · NVD - Critical 9.8
CVE-2011-4121 · Ruby
The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.
Published 26 Nov 2019 · Fixed in 1.9.3 · NVD - High 7.5
CVE-2019-19272 · ProFTPD
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer (a variable initialized to NULL) leads to a crash when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.
Published 26 Nov 2019 · Fixed in 1.3.6 · NVD - High 7.5
CVE-2019-19271 · ProFTPD
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to proceed with a connection to the server.
Published 26 Nov 2019 · Fixed in 1.3.6 · NVD - High 7.5
CVE-2019-19270 · ProFTPD
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server.
Published 26 Nov 2019 · NVD - Medium 5.3
CVE-2011-3624 · Ruby
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Published 26 Nov 2019 · NVD - High 7.5
CVE-2011-3600 · Apache OFBiz
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to…
Published 26 Nov 2019 · NVD - Critical 9.8
CVE-2011-3583 · TYPO3
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.
Published 26 Nov 2019 · NVD - Medium 6.1
CVE-2019-17632 · Eclipse Jetty
In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.
Published 25 Nov 2019 · NVD - High 7.5
CVE-2019-19244 · SQLite
sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
Published 25 Nov 2019 · NVD - High 7.5
CVE-2019-19246 · PHP
Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.
Published 25 Nov 2019 · Fixed in 7.3.10 · NVD - High 7.5
CVE-2019-11287 · RabbitMQ
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting…
Published 23 Nov 2019 · Fixed in 3.8.1 · NVD - Medium 4.8
CVE-2019-11291 · RabbitMQ
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name…
Published 22 Nov 2019 · Fixed in 1.16.7, 1.17.4, 3.7.20 · NVD - Medium 6.5
CVE-2019-15593 · GitLab
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
Published 22 Nov 2019 · NVD - Critical 9.8
CVE-2019-18622 · phpMyAdmin
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
Published 22 Nov 2019 · Fixed in 4.9.2 · NVD - High 7.5
CVE-2012-6079 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor
Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.