UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,865
Published in 7 days
987
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,865 vulnerabilities
  1. High 7.5

    CVE-2019-8087 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  2. High 7.5

    CVE-2019-8086 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  3. Medium 6.1

    CVE-2019-8085 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  4. Medium 6.1

    CVE-2019-8084 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  5. Medium 6.1

    CVE-2019-8083 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  6. High 7.5

    CVE-2019-8082 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  7. High 7.5

    CVE-2019-8081 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  8. Medium 6.1

    CVE-2019-8080 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.

    Published 24 Oct 2019 · NVD
  9. Medium 6.1

    CVE-2019-8079 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 24 Oct 2019 · NVD
  10. Medium 6.1

    CVE-2019-8078 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 24 Oct 2019 · NVD
  11. Critical 9.8

    CVE-2019-15929 · Craft CMS

    In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.

    Published 24 Oct 2019 · NVD
  12. High 7.5

    CVE-2019-15703 · Fortinet FortiOS

    An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual ECDSA authentication via the help of flush+reload side channel attacks in FortiGate VM models only.

    Published 24 Oct 2019 · Fixed in 6.0.9, 6.2.3 · NVD
  13. Medium 6.1

    CVE-2019-18348 · Python

    An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947…

    Published 23 Oct 2019 · Fixed in 3.6.11, 3.7.8, 3.8.3 · NVD
  14. High 7.5

    CVE-2019-18277 · HAProxy

    A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the…

    Published 23 Oct 2019 · Fixed in 2.0.6 · NVD
  15. High 7.5

    CVE-2019-10079 · Apache Traffic Server

    Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.

    Published 22 Oct 2019 · Fixed in 7.1.7, 8.0.4 · NVD
  16. Medium 6.1

    CVE-2019-17220 · Rocket.Chat

    Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.

    Published 21 Oct 2019 · Fixed in 2.1.0 · NVD
  17. High 7.2

    CVE-2019-16530 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

    Published 21 Oct 2019 · NVD
  18. High 7.5

    CVE-2019-18217 · ProFTPD

    ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.

    Published 21 Oct 2019 · NVD
  19. Unrated

    WPV-55df299305e7 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 19 Oct 2019 · WPVulnerability
  20. High 7.5

    CVE-2019-16919 · Harbor

    Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.

    Published 18 Oct 2019 · NVD
  21. High 7.5

    CVE-2019-6476 · BIND 9

    A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.

    Published 17 Oct 2019 · NVD
  22. High 7.5

    CVE-2019-6475 · BIND 9

    Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type secondary, except that its data is subject to DNSSEC validation before being used in answers, as if it had been looked up via traditional recursion, and when mirror zone data cannot be validated, BIND falls back to using traditional recursion…

    Published 17 Oct 2019 · NVD
  23. High 8.8

    CVE-2019-14287 · sudo

    In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

    Published 17 Oct 2019 · Fixed in 1.8.28 · NVD
  24. High 7.5

    CVE-2019-11253 · Kubernetes

    Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that…

    Published 17 Oct 2019 · Fixed in 1.14.8, 1.15.5, 1.16.2 · NVD
  25. High 8.8

    CVE-2019-17675 · WordPress

    WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  26. Medium 5.4

    CVE-2019-17674 · WordPress

    WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  27. High 7.5

    CVE-2019-17673 · WordPress

    WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  28. Medium 6.1

    CVE-2019-17672 · WordPress

    WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  29. Medium 5.3

    CVE-2019-17671 · WordPress

    In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  30. Critical 9.8

    CVE-2019-17670 · WordPress

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  31. Critical 9.8

    CVE-2019-17669 · WordPress

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  32. Medium 4.4

    CVE-2019-3018 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 16 Oct 2019 · NVD
  33. Medium 6.5

    CVE-2019-3011 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Oct 2019 · NVD
  34. Medium 4.4

    CVE-2019-3009 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Oct 2019 · NVD
  35. Medium 6.5

    CVE-2019-3004 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Oct 2019 · NVD
  36. Medium 4.9

    CVE-2019-3003 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 16 Oct 2019 · NVD
  37. Medium 4.7

    CVE-2019-2999 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 16 Oct 2019 · NVD
  38. Medium 4.9

    CVE-2019-2998 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Oct 2019 · NVD
  39. Medium 4.9

    CVE-2019-2997 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Oct 2019 · NVD
  40. Medium 4.2

    CVE-2019-2996 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other…

    Published 16 Oct 2019 · NVD
  41. Medium 5.3

    CVE-2019-2993 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Oct 2019 · NVD
  42. Low 3.7

    CVE-2019-2992 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result…

    Published 16 Oct 2019 · NVD
  43. Medium 5.5

    CVE-2019-2991 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.017 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Oct 2019 · NVD
  44. Medium 6.8

    CVE-2019-2989 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java…

    Published 16 Oct 2019 · NVD
  45. Low 3.7

    CVE-2019-2988 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result…

    Published 16 Oct 2019 · NVD
  46. Low 3.7

    CVE-2019-2987 · Java

    Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)…

    Published 16 Oct 2019 · NVD
  47. Low 3.7

    CVE-2019-2983 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability…

    Published 16 Oct 2019 · NVD
  48. Medium 4.9

    CVE-2019-2982 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Oct 2019 · NVD
  49. Low 3.7

    CVE-2019-2981 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result…

    Published 16 Oct 2019 · NVD
  50. Low 3.7

    CVE-2019-2978 · Java

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can…

    Published 16 Oct 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.