UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,888
Published in 7 days
1,006
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,888 vulnerabilities
  1. High 8.8

    CVE-2016-10802 · cPanel & WHM

    cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).

    Published 7 Aug 2019 · Fixed in 11.54.0.26, 56.0.27, 58.0.4 · NVD
  2. High 8.8

    CVE-2016-10801 · cPanel & WHM

    cPanel before 58.0.4 has improper session handling for shared users (SEC-139).

    Published 7 Aug 2019 · Fixed in 11.54.0.26, 56.0.27, 58.0.4 · NVD
  3. High 7.8

    CVE-2016-10800 · cPanel & WHM

    cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).

    Published 7 Aug 2019 · Fixed in 56.0.27, 58.0.4 · NVD
  4. Medium 5.5

    CVE-2016-10799 · cPanel & WHM

    cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).

    Published 7 Aug 2019 · Fixed in 11.54.0.26, 56.0.27, 58.0.4 · NVD
  5. Medium 6.8

    CVE-2016-10798 · cPanel & WHM

    cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).

    Published 7 Aug 2019 · Fixed in 56.0.27, 58.0.4 · NVD
  6. High 7.1

    CVE-2019-2386 · MongoDB

    After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.…

    Published 6 Aug 2019 · Fixed in 3.4.22, 3.6.13, 4.0.9 · NVD
  7. Medium 4.3

    CVE-2016-10797 · cPanel & WHM

    cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).

    Published 6 Aug 2019 · Fixed in 56.0.27, 58.0.4 · NVD
  8. Low 3.3

    CVE-2016-10796 · cPanel & WHM

    cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).

    Published 6 Aug 2019 · Fixed in 11.54.0.26, 56.0.27, 58.0.4 · NVD
  9. Medium 6.1

    CVE-2016-10795 · cPanel & WHM

    cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).

    Published 6 Aug 2019 · Fixed in 56.0.34, 58.0.29, 59.9999.145 · NVD
  10. Medium 6.5

    CVE-2016-10794 · cPanel & WHM

    cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).

    Published 6 Aug 2019 · Fixed in 56.0.34, 58.0.29, 59.9999.145 · NVD
  11. High 8.8

    CVE-2016-10793 · cPanel & WHM

    cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).

    Published 6 Aug 2019 · Fixed in 56.0.34, 58.0.29, 59.9999.145 · NVD
  12. High 8.8

    CVE-2016-10792 · cPanel & WHM

    cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).

    Published 6 Aug 2019 · Fixed in 56.0.34, 58.0.29, 59.9999.145 · NVD
  13. Medium 5.3

    CVE-2016-10791 · cPanel & WHM

    cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).

    Published 6 Aug 2019 · Fixed in 60.0.15 · NVD
  14. High 7.5

    CVE-2016-10790 · cPanel & WHM

    cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  15. High 8.8

    CVE-2016-10789 · cPanel & WHM

    cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  16. High 8.8

    CVE-2016-10788 · cPanel & WHM

    cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  17. High 8.1

    CVE-2016-10787 · cPanel & WHM

    The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  18. Medium 6.5

    CVE-2016-10786 · cPanel & WHM

    cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  19. Medium 6.5

    CVE-2016-10785 · cPanel & WHM

    cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  20. Medium 5.4

    CVE-2016-10784 · cPanel & WHM

    cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  21. Medium 5.4

    CVE-2016-10783 · cPanel & WHM

    cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  22. Medium 5.4

    CVE-2016-10782 · cPanel & WHM

    cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  23. Medium 5.4

    CVE-2016-10781 · cPanel & WHM

    cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  24. Medium 5.4

    CVE-2016-10780 · cPanel & WHM

    cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  25. Medium 5.4

    CVE-2016-10779 · cPanel & WHM

    cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  26. Medium 5.4

    CVE-2016-10778 · cPanel & WHM

    cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  27. Medium 5.4

    CVE-2016-10777 · cPanel & WHM

    cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  28. Medium 5.4

    CVE-2016-10776 · cPanel & WHM

    cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).

    Published 6 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  29. Medium 6.5

    CVE-2017-18482 · cPanel & WHM

    cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  30. Medium 5.4

    CVE-2017-18481 · cPanel & WHM

    cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  31. Medium 6.5

    CVE-2017-18480 · cPanel & WHM

    cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  32. Medium 6.5

    CVE-2017-18479 · cPanel & WHM

    In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  33. Medium 6.5

    CVE-2017-18478 · cPanel & WHM

    In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  34. Medium 6.5

    CVE-2017-18477 · cPanel & WHM

    In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  35. High 7.5

    CVE-2017-18476 · cPanel & WHM

    Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  36. High 8.8

    CVE-2017-18475 · cPanel & WHM

    In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  37. Medium 6.5

    CVE-2017-18474 · cPanel & WHM

    cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  38. Medium 5.4

    CVE-2017-18473 · cPanel & WHM

    cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  39. Medium 6.1

    CVE-2017-18472 · cPanel & WHM

    cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  40. Medium 5.4

    CVE-2017-18471 · cPanel & WHM

    cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  41. High 8.8

    CVE-2017-18470 · cPanel & WHM

    cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).

    Published 5 Aug 2019 · Fixed in 58.0.43, 60.0.35, 62.0.4 · NVD
  42. Medium 6.3

    CVE-2017-18469 · cPanel & WHM

    cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).

    Published 5 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  43. Medium 6.5

    CVE-2016-10775 · cPanel & WHM

    cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).

    Published 5 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  44. Medium 5.4

    CVE-2016-10774 · cPanel & WHM

    cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).

    Published 5 Aug 2019 · Fixed in 60.0.25 · NVD
  45. High 8.8

    CVE-2016-10773 · cPanel & WHM

    cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).

    Published 5 Aug 2019 · Fixed in 60.0.25 · NVD
  46. Low 3.3

    CVE-2016-10772 · cPanel & WHM

    cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).

    Published 5 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  47. High 8.1

    CVE-2016-10771 · cPanel & WHM

    cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).

    Published 5 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  48. Medium 6.5

    CVE-2016-10770 · cPanel & WHM

    cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).

    Published 5 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  49. Medium 6.1

    CVE-2016-10769 · cPanel & WHM

    cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).

    Published 5 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  50. Medium 6.5

    CVE-2016-10768 · cPanel & WHM

    cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).

    Published 5 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.