Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,888
- Published in 7 days
- 1,006
- Critical in 30 days
- 360
- Actively exploited
- 423
Latest vulnerabilities
39,888 vulnerabilities- Critical 9.8
CVE-2018-14671 · ClickHouse
In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.
Published 15 Aug 2019 · Fixed in 18.10.3 · NVD - Critical 9.8
CVE-2018-14670 · ClickHouse
Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.
Published 15 Aug 2019 · Fixed in 1.1.54131 · NVD - High 7.5
CVE-2018-14669 · ClickHouse
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.
Published 15 Aug 2019 · Fixed in 1.1.54390 · NVD - High 8.8
CVE-2018-14668 · ClickHouse
In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.
Published 15 Aug 2019 · Fixed in 1.1.54388 · NVD - High 7.5
CVE-2019-12854 · Squid
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.
Published 15 Aug 2019 · NVD - Medium 4.8
CVE-2019-15081 · OpenCart
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
Published 15 Aug 2019 · NVD - High 8.0
CVE-2019-15062 · Dolibarr ERP CRM
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this…
Published 14 Aug 2019 · NVD - Medium 5.3
CVE-2019-15028 · Joomla!
In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.
Published 14 Aug 2019 · Fixed in 3.9.11 · NVD - High 7.5
CVE-2019-9518 · Apache Traffic Server, Node.js
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD - High 7.5
CVE-2019-9517 · Apache HTTP Server, Apache Traffic Server, Node.js
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending…
Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD - Medium 6.5
CVE-2019-9516 · Apache Traffic Server, nginx, Node.js
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD - High 7.5
CVE-2019-9515 · Apache Traffic Server, F5 BIG-IP, Node.js
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess…
Published 13 Aug 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.0.1.1 · NVD - High 7.5
CVE-2019-9514 · Apache Traffic Server, F5 BIG-IP, Node.js
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Published 13 Aug 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.0.1.1 · NVD - High 7.5
CVE-2019-9513 · Apache Traffic Server, nginx, Node.js
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD - High 7.5
CVE-2019-9512 · Apache Traffic Server, Node.js
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD - High 7.5
CVE-2019-9511 · Apache Traffic Server, nginx, Node.js
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is…
Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD - Medium 5.3
CVE-2019-8448 · Jira
The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
Published 13 Aug 2019 · Fixed in 7.13.4, 8.2.2 · NVD - Medium 6.5
CVE-2019-14981 · ImageMagick
In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
Published 12 Aug 2019 · Fixed in 6.9.10-41, 7.0.8-41 · NVD - Medium 6.5
CVE-2019-14980 · ImageMagick
In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
Published 12 Aug 2019 · Fixed in 6.9.10-42, 7.0.8-42 · NVD - Medium 6.1
CVE-2019-14967 · Frappe Framework
An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability.
Published 12 Aug 2019 · Fixed in 11.1.46 · NVD - High 8.8
CVE-2019-14966 · Frappe Framework
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection.
Published 12 Aug 2019 · NVD - Critical 9.8
CVE-2019-14965 · Frappe Framework
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists.
Published 12 Aug 2019 · Fixed in 12.0.4 · NVD - Critical 9.8
CVE-2019-12261 · SonicWall SonicOS
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.
Published 9 Aug 2019 · NVD - Critical 9.8
CVE-2019-12260 · SonicWall SonicOS
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.
Published 9 Aug 2019 · NVD - High 7.5
CVE-2019-12258 · SonicWall SonicOS
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.
Published 9 Aug 2019 · NVD - Critical 9.8
CVE-2019-12255 · SonicWall SonicOS
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
Published 9 Aug 2019 · NVD - Critical 9.8Actively exploited
CVE-2019-11581 · Jira
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0…
Published 9 Aug 2019 · Fixed in 8.0.3, 8.1.2, 8.2.3 · NVD - High 7.1
CVE-2019-11042 · PHP
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Published 9 Aug 2019 · Fixed in 7.1.31, 7.2.21, 7.3.8 · NVD - High 7.1
CVE-2019-11041 · PHP
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Published 9 Aug 2019 · Fixed in 7.1.31, 7.2.21, 7.3.8 · NVD - Medium 5.4
CVE-2018-20827 · Jira
The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.
Published 9 Aug 2019 · Fixed in 7.13.1 · NVD - Medium 4.3
CVE-2018-20826 · Jira
The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.
Published 9 Aug 2019 · Fixed in 7.12.3 · NVD - Medium 5.3
CVE-2019-12265 · SonicWall SonicOS
Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.
Published 9 Aug 2019 · NVD - High 8.1
CVE-2019-12263 · SonicWall SonicOS
Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.
Published 9 Aug 2019 · NVD - High 7.5
CVE-2019-12259 · SonicWall SonicOS
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
Published 9 Aug 2019 · NVD - High 8.8
CVE-2019-12257 · SonicWall SonicOS
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
Published 9 Aug 2019 · NVD - Critical 9.8
CVE-2019-12256 · SonicWall SonicOS
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
Published 9 Aug 2019 · NVD - Critical 9.8
CVE-2019-14771 · Backdrop CMS
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export…
Published 8 Aug 2019 · Fixed in 1.12.8, 1.13.3 · NVD - Medium 6.1
CVE-2019-14769 · Backdrop CMS
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering a layout. (This issue is mitigated by the attacker needing permission to create custom blocks on the site, which is…
Published 8 Aug 2019 · Fixed in 1.12.8, 1.13.3 · NVD - Medium 6.1
CVE-2019-14774 · Woo Variation Swatches (WordPress plugin)
Variation Swatches for WooCommerce: Cross-site Scripting
Published 8 Aug 2019 · Fixed in 1.0.62 · WPVulnerability - High 8.8
CVE-2019-1934 · Cisco ASA and Firepower Threat Defense
A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to elevate privileges and execute administrative functions on an affected device. The vulnerability is due to insufficient authorization validation. An attacker could exploit this vulnerability by logging in to an affected device as a…
Published 7 Aug 2019 · NVD - High 8.8
CVE-2016-10812 · cPanel & WHM
In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - High 8.8
CVE-2016-10811 · cPanel & WHM
In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - High 8.8
CVE-2016-10810 · cPanel & WHM
In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - High 8.8
CVE-2016-10809 · cPanel & WHM
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - High 8.8
CVE-2016-10808 · cPanel & WHM
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - Medium 6.5
CVE-2016-10807 · cPanel & WHM
cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - Medium 5.4
CVE-2016-10806 · cPanel & WHM
cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - High 8.8
CVE-2016-10805 · cPanel & WHM
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - High 8.1
CVE-2016-10804 · cPanel & WHM
The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
Published 7 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD - High 7.5
CVE-2016-10803 · cPanel & WHM
cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
Published 7 Aug 2019 · Fixed in 57.9999.105 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.