UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,889
Published in 7 days
1,004
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,889 vulnerabilities
  1. Critical 9.8

    CVE-2016-10824 · cPanel & WHM

    cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  2. High 8.8

    CVE-2016-10823 · cPanel & WHM

    cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  3. Medium 5.4

    CVE-2016-10822 · cPanel & WHM

    cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  4. Medium 5.4

    CVE-2018-20935 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  5. Medium 6.5

    CVE-2018-20934 · cPanel & WHM

    cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  6. Medium 5.4

    CVE-2018-20933 · cPanel & WHM

    cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  7. Low 2.7

    CVE-2018-20932 · cPanel & WHM

    cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  8. Medium 6.3

    CVE-2018-20931 · cPanel & WHM

    cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  9. Medium 6.5

    CVE-2018-20930 · cPanel & WHM

    cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  10. Medium 6.1

    CVE-2018-20929 · cPanel & WHM

    cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  11. Medium 6.1

    CVE-2018-20928 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  12. Low 3.8

    CVE-2018-20927 · cPanel & WHM

    cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  13. Medium 6.7

    CVE-2018-20926 · cPanel & WHM

    cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  14. Medium 6.7

    CVE-2018-20925 · cPanel & WHM

    cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  15. Medium 5.5

    CVE-2018-20924 · cPanel & WHM

    cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  16. Medium 6.5

    CVE-2016-10849 · cPanel & WHM

    cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  17. High 7.2

    CVE-2016-10848 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  18. High 8.1

    CVE-2016-10847 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  19. High 8.1

    CVE-2016-10846 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  20. High 8.1

    CVE-2016-10845 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  21. Medium 6.5

    CVE-2016-10844 · cPanel & WHM

    The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  22. High 8.1

    CVE-2016-10843 · cPanel & WHM

    cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  23. Medium 6.5

    CVE-2016-10842 · cPanel & WHM

    cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  24. Medium 5.3

    CVE-2016-10841 · cPanel & WHM

    The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  25. High 8.8

    CVE-2016-10840 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  26. High 8.1

    CVE-2016-10839 · cPanel & WHM

    cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  27. Medium 6.5

    CVE-2016-10838 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  28. High 7.5

    CVE-2016-10837 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  29. Medium 6.5

    CVE-2016-10836 · cPanel & WHM

    cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).

    Published 1 Aug 2019 · Fixed in 11.52.4.1, 11.54.0.20, 55.9999.141 · NVD
  30. Medium 6.1

    CVE-2018-20923 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  31. Medium 6.1

    CVE-2018-20922 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  32. Medium 6.1

    CVE-2018-20921 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  33. Medium 6.1

    CVE-2018-20920 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  34. Medium 6.1

    CVE-2018-20919 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  35. Medium 6.1

    CVE-2018-20918 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  36. Medium 5.5

    CVE-2018-20917 · cPanel & WHM

    cPanel before 70.0.23 allows any user to disable Solr (SEC-371).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  37. Medium 5.4

    CVE-2018-20916 · cPanel & WHM

    cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  38. Medium 5.4

    CVE-2018-20915 · cPanel & WHM

    cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  39. High 7.3

    CVE-2018-20914 · cPanel & WHM

    In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  40. Medium 4.9

    CVE-2018-20913 · cPanel & WHM

    cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  41. Medium 6.3

    CVE-2018-20912 · cPanel & WHM

    cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  42. High 7.2

    CVE-2018-20911 · cPanel & WHM

    cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  43. Medium 6.1

    CVE-2018-20910 · cPanel & WHM

    cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).

    Published 1 Aug 2019 · Fixed in 70.0.23 · NVD
  44. High 7.1

    CVE-2018-20909 · cPanel & WHM

    cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).

    Published 1 Aug 2019 · Fixed in 62.0.42, 68.0.33, 70.0.23 · NVD
  45. Medium 5.5

    CVE-2018-20908 · cPanel & WHM

    cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).

    Published 1 Aug 2019 · Fixed in 62.0.47, 68.0.39, 70.0.43 · NVD
  46. Medium 4.3

    CVE-2018-20907 · cPanel & WHM

    cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).

    Published 1 Aug 2019 · Fixed in 68.0.39, 70.0.43, 71.9980.37 · NVD
  47. Medium 4.3

    CVE-2018-20906 · cPanel & WHM

    cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).

    Published 1 Aug 2019 · Fixed in 62.0.47, 68.0.39, 70.0.43 · NVD
  48. Medium 5.4

    CVE-2018-20905 · cPanel & WHM

    cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429).

    Published 1 Aug 2019 · Fixed in 68.0.39, 70.0.43, 71.9980.37 · NVD
  49. Medium 4.3

    CVE-2018-20904 · cPanel & WHM

    cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).

    Published 1 Aug 2019 · Fixed in 62.0.47, 68.0.39, 70.0.43 · NVD
  50. Medium 6.1

    CVE-2018-20903 · cPanel & WHM

    cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).

    Published 1 Aug 2019 · Fixed in 71.9980.37 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.