UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,889
Published in 7 days
1,004
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,889 vulnerabilities
  1. Low 2.7

    CVE-2017-18393 · cPanel & WHM

    cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  2. Low 2.0

    CVE-2017-18392 · cPanel & WHM

    cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  3. Low 2.5

    CVE-2017-18391 · cPanel & WHM

    cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  4. High 7.8

    CVE-2017-18390 · cPanel & WHM

    cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  5. Medium 6.3

    CVE-2017-18389 · cPanel & WHM

    cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  6. High 7.8

    CVE-2017-18388 · cPanel & WHM

    cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  7. High 7.2

    CVE-2017-18387 · cPanel & WHM

    cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  8. High 7.2

    CVE-2017-18386 · cPanel & WHM

    cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  9. Medium 5.5

    CVE-2017-18385 · cPanel & WHM

    cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  10. Low 3.8

    CVE-2017-18384 · cPanel & WHM

    cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  11. High 7.8

    CVE-2017-18383 · cPanel & WHM

    cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  12. Low 2.7

    CVE-2017-18382 · cPanel & WHM

    cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).

    Published 2 Aug 2019 · Fixed in 64.0.42, 66.0.34, 68.0.15 · NVD
  13. High 8.8

    CVE-2016-10826 · cPanel & WHM

    cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).

    Published 1 Aug 2019 · Fixed in 11.50.5.2, 11.52.4.1, 11.54.0.20 · NVD
  14. Medium 6.5

    CVE-2016-10821 · cPanel & WHM

    In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).

    Published 1 Aug 2019 · Fixed in 11.50.5.2, 11.52.4.1, 11.54.0.20 · NVD
  15. High 8.8

    CVE-2016-10820 · cPanel & WHM

    cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).

    Published 1 Aug 2019 · Fixed in 11.50.5.2, 11.52.4.1, 11.54.0.20 · NVD
  16. Medium 6.5

    CVE-2016-10819 · cPanel & WHM

    In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).

    Published 1 Aug 2019 · Fixed in 11.52.6.1, 11.54.0.24, 56.0.15 · NVD
  17. Medium 6.5

    CVE-2016-10818 · cPanel & WHM

    cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).

    Published 1 Aug 2019 · Fixed in 56.0.15 · NVD
  18. Critical 9.8

    CVE-2016-10817 · cPanel & WHM

    cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).

    Published 1 Aug 2019 · Fixed in 11.52.6.1, 11.54.0.24, 56.0.15 · NVD
  19. High 8.8

    CVE-2016-10816 · cPanel & WHM

    cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).

    Published 1 Aug 2019 · Fixed in 11.52.6.1, 11.54.0.24, 56.0.15 · NVD
  20. Medium 6.5

    CVE-2016-10815 · cPanel & WHM

    cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).

    Published 1 Aug 2019 · Fixed in 11.52.6.1, 11.54.0.24, 56.0.15 · NVD
  21. High 8.8

    CVE-2016-10814 · cPanel & WHM

    cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).

    Published 1 Aug 2019 · Fixed in 11.52.6.1, 11.54.0.24, 56.0.15 · NVD
  22. Medium 5.4

    CVE-2016-10813 · cPanel & WHM

    cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).

    Published 1 Aug 2019 · Fixed in 11.54.0.24, 56.0.15, 57.9999.54 · NVD
  23. Medium 6.1

    CVE-2018-20953 · cPanel & WHM

    cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  24. Medium 6.5

    CVE-2018-20952 · cPanel & WHM

    cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  25. Medium 6.1

    CVE-2018-20951 · cPanel & WHM

    cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  26. Medium 6.1

    CVE-2018-20950 · cPanel & WHM

    cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  27. Medium 6.1

    CVE-2018-20949 · cPanel & WHM

    cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  28. Medium 6.1

    CVE-2018-20948 · cPanel & WHM

    cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  29. Medium 5.5

    CVE-2018-20947 · cPanel & WHM

    cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  30. Low 3.3

    CVE-2018-20946 · cPanel & WHM

    cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  31. Medium 5.7

    CVE-2018-20945 · cPanel & WHM

    bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  32. Low 3.3

    CVE-2018-20944 · cPanel & WHM

    cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  33. Low 2.5

    CVE-2018-20943 · cPanel & WHM

    cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  34. Low 2.5

    CVE-2018-20942 · cPanel & WHM

    cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  35. Medium 5.6

    CVE-2018-20941 · cPanel & WHM

    cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349).

    Published 1 Aug 2019 · Fixed in 68.0.27 · NVD
  36. Low 3.3

    CVE-2018-20940 · cPanel & WHM

    cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  37. Low 3.3

    CVE-2018-20939 · cPanel & WHM

    cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  38. Low 2.7

    CVE-2018-20938 · cPanel & WHM

    cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).

    Published 1 Aug 2019 · Fixed in 68.0.27 · NVD
  39. Medium 4.3

    CVE-2018-20937 · cPanel & WHM

    cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  40. Low 3.3

    CVE-2018-20936 · cPanel & WHM

    cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).

    Published 1 Aug 2019 · Fixed in 62.0.39, 66.0.35, 68.0.27 · NVD
  41. Medium 4.3

    CVE-2016-10835 · cPanel & WHM

    cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  42. High 8.8

    CVE-2016-10834 · cPanel & WHM

    cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  43. High 7.5

    CVE-2016-10833 · cPanel & WHM

    cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  44. Medium 6.5

    CVE-2016-10832 · cPanel & WHM

    cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  45. High 7.2

    CVE-2016-10831 · cPanel & WHM

    cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).

    Published 1 Aug 2019 · Fixed in 11.54.0.20, 55.9999.141 · NVD
  46. High 8.1

    CVE-2016-10830 · cPanel & WHM

    cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  47. Medium 6.5

    CVE-2016-10829 · cPanel & WHM

    cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  48. High 8.8

    CVE-2016-10828 · cPanel & WHM

    cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  49. Medium 5.4

    CVE-2016-10827 · cPanel & WHM

    cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  50. High 8.1

    CVE-2016-10825 · cPanel & WHM

    cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.