Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,889
- Published in 7 days
- 1,007
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,889 vulnerabilities- Medium 5.8
CVE-2017-18443 · cPanel & WHM
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - Medium 5.3
CVE-2017-18442 · cPanel & WHM
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - Medium 5.0
CVE-2017-18441 · cPanel & WHM
cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - Medium 4.3
CVE-2017-18440 · cPanel & WHM
cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - Medium 6.3
CVE-2017-18439 · cPanel & WHM
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - Medium 6.3
CVE-2017-18438 · cPanel & WHM
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - Medium 4.4
CVE-2017-18437 · cPanel & WHM
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - Low 3.5
CVE-2017-18436 · cPanel & WHM
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - High 7.3
CVE-2017-18435 · cPanel & WHM
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - High 7.8
CVE-2017-18434 · cPanel & WHM
cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - High 8.8
CVE-2017-18433 · cPanel & WHM
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - High 7.8
CVE-2017-18432 · cPanel & WHM
In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).
Published 2 Aug 2019 · Fixed in 60.0.43, 62.0.24, 64.0.21 · NVD - High 7.5
CVE-2017-18431 · cPanel & WHM
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
Published 2 Aug 2019 · Fixed in 66.0.1 · NVD - Medium 4.7
CVE-2017-18430 · cPanel & WHM
In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 3.3
CVE-2017-18429 · cPanel & WHM
In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 2.5
CVE-2017-18428 · cPanel & WHM
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 3.3
CVE-2017-18427 · cPanel & WHM
In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 2.7
CVE-2017-18426 · cPanel & WHM
cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
Published 2 Aug 2019 · Fixed in 66.0.2 · NVD - Low 2.5
CVE-2017-18425 · cPanel & WHM
In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 3.3
CVE-2017-18424 · cPanel & WHM
In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 3.3
CVE-2017-18423 · cPanel & WHM
In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 3.3
CVE-2017-18422 · cPanel & WHM
In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Low 3.3
CVE-2017-18421 · cPanel & WHM
cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).
Published 2 Aug 2019 · Fixed in 62.0.27, 64.0.33, 66.0.2 · NVD - Medium 5.4
CVE-2017-18420 · cPanel & WHM
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
Published 2 Aug 2019 · Fixed in 66.0.2 · NVD - Medium 5.4
CVE-2017-18419 · cPanel & WHM
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
Published 2 Aug 2019 · Fixed in 66.0.2 · NVD - Medium 5.4
CVE-2017-18418 · cPanel & WHM
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
Published 2 Aug 2019 · Fixed in 66.0.2 · NVD - Medium 5.4
CVE-2017-18417 · cPanel & WHM
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
Published 2 Aug 2019 · Fixed in 66.0.2 · NVD - Medium 5.5
CVE-2017-18416 · cPanel & WHM
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - High 7.8
CVE-2017-18415 · cPanel & WHM
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - High 7.4
CVE-2017-18414 · cPanel & WHM
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - High 7.8
CVE-2017-18413 · cPanel & WHM
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - Low 2.5
CVE-2017-18412 · cPanel & WHM
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - Medium 6.8
CVE-2017-18411 · cPanel & WHM
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - Medium 6.5
CVE-2017-18410 · cPanel & WHM
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - Medium 6.5
CVE-2017-18409 · cPanel & WHM
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - Medium 5.4
CVE-2017-18408 · cPanel & WHM
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - Medium 4.8
CVE-2017-18407 · cPanel & WHM
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - High 7.5
CVE-2017-18406 · cPanel & WHM
cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).
Published 2 Aug 2019 · Fixed in 64.0.40, 66.0.23, 67.9999.103 · NVD - Medium 5.5
CVE-2017-18405 · cPanel & WHM
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Low 3.1
CVE-2017-18404 · cPanel & WHM
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Medium 6.3
CVE-2017-18403 · cPanel & WHM
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Medium 5.4
CVE-2017-18402 · cPanel & WHM
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Low 2.7
CVE-2017-18401 · cPanel & WHM
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - High 7.8
CVE-2017-18400 · cPanel & WHM
cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Low 3.7
CVE-2017-18399 · cPanel & WHM
cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Low 3.8
CVE-2017-18398 · cPanel & WHM
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Low 3.3
CVE-2017-18397 · cPanel & WHM
cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Medium 5.5
CVE-2017-18396 · cPanel & WHM
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Low 2.7
CVE-2017-18395 · cPanel & WHM
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD - Low 2.7
CVE-2017-18394 · cPanel & WHM
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.