UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,889
Published in 7 days
1,007
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,889 vulnerabilities
  1. High 8.8

    CVE-2019-7885 · Magento / Adobe Commerce

    Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure the catalog search.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  2. Medium 5.4

    CVE-2019-7882 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  3. Medium 5.4

    CVE-2019-7881 · Magento / Adobe Commerce

    A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack).

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  4. Medium 4.8

    CVE-2019-7880 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to marketing email templates to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  5. Medium 6.1

    CVE-2019-7877 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  6. High 8.8

    CVE-2019-7876 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  7. Medium 4.8

    CVE-2019-7875 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  8. Medium 6.5

    CVE-2019-7874 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  9. Medium 4.3

    CVE-2019-7873 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  10. Medium 6.5

    CVE-2019-7872 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  11. High 8.8

    CVE-2019-7871 · Magento / Adobe Commerce

    A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  12. Medium 4.8

    CVE-2019-7869 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage customer groups.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  13. Medium 4.8

    CVE-2019-7868 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  14. Medium 4.8

    CVE-2019-7867 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  15. Medium 4.8

    CVE-2019-7866 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  16. High 8.8

    CVE-2019-7865 · Magento / Adobe Commerce

    A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  17. Medium 5.3

    CVE-2019-7864 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  18. Medium 4.8

    CVE-2019-7863 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  19. Medium 4.8

    CVE-2019-7862 · Magento / Adobe Commerce

    A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  20. High 7.5

    CVE-2019-7861 · Magento / Adobe Commerce

    Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  21. High 7.5

    CVE-2019-7860 · Magento / Adobe Commerce

    A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  22. High 7.5

    CVE-2019-7859 · Magento / Adobe Commerce

    A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  23. High 7.5

    CVE-2019-7858 · Magento / Adobe Commerce

    A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that is insufficiently resistant to brute force attacks.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  24. Medium 4.3

    CVE-2019-7857 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an insufficiently robust anti-CSRF token implementation.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  25. Medium 5.3

    CVE-2019-7855 · Magento / Adobe Commerce

    A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  26. High 7.5

    CVE-2019-7854 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  27. Medium 4.8

    CVE-2019-7853 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the tax notifications configuration in the Magento admin panel.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  28. Medium 5.3

    CVE-2019-7852 · Magento / Adobe Commerce

    A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  29. Medium 6.5

    CVE-2019-7851 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from customer pages.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  30. High 7.5

    CVE-2019-7849 · Magento / Adobe Commerce

    A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  31. Critical 9.8

    CVE-2019-14544 · Gogs

    routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.

    Published 2 Aug 2019 · NVD
  32. High 7.8

    CVE-2017-18463 · cPanel & WHM

    cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).

    Published 2 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  33. Medium 4.3

    CVE-2017-18461 · cPanel & WHM

    cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).

    Published 2 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  34. High 7.8

    CVE-2017-18460 · cPanel & WHM

    cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).

    Published 2 Aug 2019 · Fixed in 60.0.39, 62.0.17 · NVD
  35. High 7.8

    CVE-2017-18459 · cPanel & WHM

    cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).

    Published 2 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  36. Low 3.3

    CVE-2017-18458 · cPanel & WHM

    cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).

    Published 2 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  37. Medium 4.4

    CVE-2017-18457 · cPanel & WHM

    cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).

    Published 2 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  38. Medium 6.1

    CVE-2017-18456 · cPanel & WHM

    cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).

    Published 2 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  39. Low 2.7

    CVE-2017-18455 · cPanel & WHM

    In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).

    Published 2 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  40. Medium 5.4

    CVE-2017-18454 · cPanel & WHM

    cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).

    Published 2 Aug 2019 · Fixed in 58.0.49, 60.0.43, 62.0.24 · NVD
  41. Medium 4.9

    CVE-2017-18453 · cPanel & WHM

    cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  42. Medium 6.7

    CVE-2017-18452 · cPanel & WHM

    cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  43. Medium 5.3

    CVE-2017-18451 · cPanel & WHM

    cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  44. Medium 4.5

    CVE-2017-18450 · cPanel & WHM

    cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  45. Medium 5.5

    CVE-2017-18449 · cPanel & WHM

    cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  46. Medium 5.3

    CVE-2017-18448 · cPanel & WHM

    cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  47. Medium 6.3

    CVE-2017-18447 · cPanel & WHM

    cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  48. Medium 6.3

    CVE-2017-18446 · cPanel & WHM

    cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  49. Medium 4.3

    CVE-2017-18445 · cPanel & WHM

    cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD
  50. Medium 5.3

    CVE-2017-18444 · cPanel & WHM

    cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).

    Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.