Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,878
- Published in 7 days
- 996
- Critical in 30 days
- 359
- Actively exploited
- 423
Latest vulnerabilities
39,878 vulnerabilities- Medium 5.4
CVE-2019-16172 · LimeSurvey
LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
Published 9 Sept 2019 · Fixed in 3.17.4 · NVD - High 7.5
CVE-2019-11605 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Information Disclosure. A small number of GitLab API endpoints would disclose project information when using a read_user scoped token.
Published 9 Sept 2019 · Fixed in 11.8.10, 11.9.11, 11.10.3 · NVD - Medium 6.5
CVE-2019-11549 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors.
Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD - Medium 5.4
CVE-2019-11548 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.
Published 9 Sept 2019 · Fixed in 11.8.9 · NVD - Medium 6.1
CVE-2019-11547 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.
Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD - Medium 5.3
CVE-2019-11546 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge.
Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD - Medium 4.3
CVE-2019-11545 · GitLab
An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue.
Published 9 Sept 2019 · Fixed in 11.9.10, 11.10.2 · NVD - Medium 4.3
CVE-2019-11544 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events.
Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD - High 7.2
CVE-2019-5473 · GitLab
An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4.
Published 9 Sept 2019 · NVD - Medium 5.4
CVE-2019-5471 · GitLab
An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6.
Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD - Medium 5.4
CVE-2019-5467 · GitLab
An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD - Medium 5.3
CVE-2019-5463 · GitLab
An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD - Low 3.5
CVE-2019-5461 · GitLab
An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD - Medium 6.5
CVE-2019-16168 · Java, MySQL, SQLite
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Published 9 Sept 2019 · NVD - Medium 6.5
CVE-2019-16097 · Harbor
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
Published 8 Sept 2019 · NVD - Medium 6.1
CVE-2018-11198 · Mautic
XSS vulnerability in Author URL of themes
Published 6 Sept 2019 · NVD, Project advisories (GitHub) - High 7.5
CVE-2019-16056 · Python
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may…
Published 6 Sept 2019 · NVD - Critical 9.8
CVE-2019-14813 · Ghostscript
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Published 6 Sept 2019 · NVD - Critical 9.8
CVE-2019-15846 · Exim
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
Published 6 Sept 2019 · Fixed in 4.92.2 · NVD - Medium 6.1
CVE-2019-15848 · TeamCity
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
Published 5 Sept 2019 · NVD - High 8.8Actively exploited
CVE-2019-15949 · Nagios XI
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user…
Published 5 Sept 2019 · Fixed in 5.6.6 · NVD - High 8.8
CVE-2019-15942 · FFmpeg
FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer.
Published 5 Sept 2019 · NVD - High 8.8
CVE-2019-6646 · F5 BIG-IP
On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges.
Published 4 Sept 2019 · NVD - High 7.5
CVE-2019-6643 · F5 BIG-IP
On versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, and 11.5.2-11.6.4, an attacker sending specifically crafted DHCPv6 requests through a BIG-IP virtual server configured with a DHCPv6 profile may be able to cause the TMM process to produce a core file.
Published 4 Sept 2019 · NVD - Medium 5.3
CVE-2019-6647 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory on the system.
Published 4 Sept 2019 · NVD - Critical 9.4
CVE-2019-6644 · F5 BIG-IP
Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible.
Published 4 Sept 2019 · NVD - High 7.5
CVE-2019-6645 · F5 BIG-IP
On BIG-IP 14.0.0-14.1.0.5, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, FTP traffic passing through a Virtual Server with both an active FTP profile associated and connection mirroring configured may lead to a TMM crash causing the configured HA action to be taken.
Published 4 Sept 2019 · NVD - Medium 6.1
CVE-2019-13209 · Rancher
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the…
Published 4 Sept 2019 · NVD - High 7.5
CVE-2019-15903 · Expat, Python
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Published 4 Sept 2019 · Fixed in 3.5.8, 3.6.10, 3.7.5 · NVD - High 7.5
CVE-2019-15892 · Varnish Cache
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
Published 3 Sept 2019 · Fixed in 6.0.4, 6.2.1 · NVD - High 8.8
CVE-2019-5475 · Sonatype Nexus Repository
The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
Published 3 Sept 2019 · NVD - High 7.8
CVE-2019-14817 · Ghostscript
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Published 3 Sept 2019 · Fixed in 9.50 · NVD - High 7.8
CVE-2019-14811 · Ghostscript
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Published 3 Sept 2019 · Fixed in 9.50 · NVD - Critical 9.1
CVE-2019-10197 · Samba
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.
Published 3 Sept 2019 · NVD - High 7.5
CVE-2019-15043 · Grafana
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
Published 3 Sept 2019 · Fixed in 5.4.5, 6.3.4 · NVD - High 7.8
CVE-2019-2390 · MongoDB
An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.
Published 30 Aug 2019 · Fixed in 3.4.22, 3.6.14, 4.0.11 · NVD - Medium 4.2
CVE-2019-2389 · MongoDB
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.
Published 30 Aug 2019 · Fixed in 3.4.22, 3.6.14, 4.0.11 · NVD - High 7.5
CVE-2019-15026 · Memcached
memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.
Published 30 Aug 2019 · NVD - High 8.8
CVE-2019-3394 · Confluence
There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under <install-directory>/confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, which could potentially leak…
Published 29 Aug 2019 · Fixed in 6.15.8 · NVD - Critical 9.8
CVE-2019-11500 · Dovecot
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
Published 29 Aug 2019 · Fixed in 2.2.36.4, 2.3.7.2 · NVD - Critical 9.8
CVE-2019-14943 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.
Published 29 Aug 2019 · NVD - Medium 6.5
CVE-2019-11250 · Kubernetes
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
Published 29 Aug 2019 · Fixed in 1.15.3 · NVD - Medium 6.5
CVE-2019-11249 · Kubernetes
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this…
Published 29 Aug 2019 · Fixed in 1.13.9, 1.14.5, 1.15.2 · NVD - High 8.2
CVE-2019-11248 · Kubernetes
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The…
Published 29 Aug 2019 · Fixed in 1.12.10 · NVD - High 8.1
CVE-2019-11247 · Kubernetes
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped…
Published 29 Aug 2019 · Fixed in 1.13.9, 1.14.5, 1.15.2 · NVD - Medium 6.5
CVE-2019-11246 · Kubernetes
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this…
Published 29 Aug 2019 · Fixed in 1.13.9, 1.14.5, 1.15.2 · NVD - High 7.8
CVE-2019-11245 · Kubernetes
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
Published 29 Aug 2019 · NVD - High 7.8Actively exploited
CVE-2019-15752 · Docker Engine
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Published 28 Aug 2019 · Fixed in 2.1.0.1 · NVD - Medium 6.1
CVE-2019-5590 · Fortinet FortiWeb
The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting) via attack reports generated in HTML form.
Published 28 Aug 2019 · NVD - High 8.8
CVE-2019-10384 · Jenkins
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
Published 28 Aug 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.