UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,889
Published in 7 days
1,003
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,889 vulnerabilities
  1. Medium 5.5

    CVE-2018-20902 · cPanel & WHM

    cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).

    Published 1 Aug 2019 · Fixed in 71.9980.37 · NVD
  2. Medium 6.1

    CVE-2018-20901 · cPanel & WHM

    cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).

    Published 1 Aug 2019 · Fixed in 71.9980.37 · NVD
  3. High 8.1

    CVE-2016-10860 · cPanel & WHM

    cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).

    Published 1 Aug 2019 · Fixed in 11.50.3.1, 11.52.0.23, 11.52.1.1 · NVD
  4. High 8.1

    CVE-2016-10859 · cPanel & WHM

    cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).

    Published 1 Aug 2019 · Fixed in 11.50.3.1, 11.52.0.23, 11.52.1.1 · NVD
  5. Critical 9.8

    CVE-2016-10858 · cPanel & WHM

    cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).

    Published 1 Aug 2019 · Fixed in 11.50.3.1, 11.52.0.23, 11.52.1.1 · NVD
  6. Medium 6.5

    CVE-2016-10857 · cPanel & WHM

    cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).

    Published 1 Aug 2019 · Fixed in 11.50.3.1, 11.52.0.23, 11.52.1.1 · NVD
  7. Medium 6.5

    CVE-2016-10856 · cPanel & WHM

    cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).

    Published 1 Aug 2019 · Fixed in 11.50.3.1, 11.52.0.23, 11.52.1.1 · NVD
  8. Critical 9.8

    CVE-2016-10855 · cPanel & WHM

    cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  9. Medium 5.4

    CVE-2016-10854 · cPanel & WHM

    cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  10. Medium 5.4

    CVE-2016-10853 · cPanel & WHM

    cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).

    Published 1 Aug 2019 · Fixed in 11.48.4.8, 11.54.0.4 · NVD
  11. Medium 6.5

    CVE-2016-10852 · cPanel & WHM

    cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  12. Medium 5.4

    CVE-2016-10851 · cPanel & WHM

    cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  13. High 8.8

    CVE-2016-10850 · cPanel & WHM

    cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).

    Published 1 Aug 2019 · Fixed in 11.50.4.3, 11.52.2.4, 11.54.0.4 · NVD
  14. High 7.5

    CVE-2015-9291 · cPanel & WHM

    cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).

    Published 1 Aug 2019 · Fixed in 11.52.0.13 · NVD
  15. High 7.2Actively exploited

    CVE-2019-0193 · Apache Solr

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a…

    Published 1 Aug 2019 · Fixed in 7.7.3, 8.1.2 · NVD
  16. Medium 6.1

    CVE-2018-20900 · cPanel & WHM

    cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).

    Published 1 Aug 2019 · Fixed in 62.0.47, 68.0.39, 70.0.43 · NVD
  17. Medium 6.1

    CVE-2018-20899 · cPanel & WHM

    cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

    Published 1 Aug 2019 · Fixed in 68.0.39, 70.0.43, 71.9980.37 · NVD
  18. Medium 4.3

    CVE-2018-20898 · cPanel & WHM

    cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

    Published 1 Aug 2019 · Fixed in 62.0.47, 68.0.39, 70.0.43 · NVD
  19. Low 2.8

    CVE-2018-20897 · cPanel & WHM

    cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).

    Published 1 Aug 2019 · Fixed in 68.0.39, 70.0.43, 71.9980.37 · NVD
  20. Low 3.9

    CVE-2018-20896 · cPanel & WHM

    cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).

    Published 1 Aug 2019 · Fixed in 68.0.39, 70.0.43, 71.9980.37 · NVD
  21. High 7.2

    CVE-2018-20895 · cPanel & WHM

    In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393).

    Published 1 Aug 2019 · Fixed in 68.0.39, 70.0.43, 71.9980.37 · NVD
  22. Low 3.3

    CVE-2018-20894 · cPanel & WHM

    cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).

    Published 1 Aug 2019 · Fixed in 72.0.10, 74.0.0 · NVD
  23. Low 2.3

    CVE-2018-20893 · cPanel & WHM

    cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).

    Published 1 Aug 2019 · Fixed in 70.0.53, 72.0.10, 74.0.0 · NVD
  24. Medium 4.3

    CVE-2018-20892 · cPanel & WHM

    cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).

    Published 1 Aug 2019 · Fixed in 70.0.53, 72.0.10, 74.0.0 · NVD
  25. Medium 5.5

    CVE-2018-20891 · cPanel & WHM

    cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).

    Published 1 Aug 2019 · Fixed in 70.0.53, 72.0.10, 74.0.0 · NVD
  26. Medium 4.3

    CVE-2018-20890 · cPanel & WHM

    cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

    Published 1 Aug 2019 · Fixed in 70.0.53, 72.0.10, 74.0.0 · NVD
  27. Medium 4.4

    CVE-2018-20889 · cPanel & WHM

    cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).

    Published 1 Aug 2019 · Fixed in 70.0.53, 72.0.10, 74.0.0 · NVD
  28. Medium 5.5

    CVE-2018-20888 · cPanel & WHM

    cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424).

    Published 1 Aug 2019 · Fixed in 70.0.53, 72.0.10, 74.0.0 · NVD
  29. Critical 9.8

    CVE-2018-20887 · cPanel & WHM

    cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

    Published 1 Aug 2019 · Fixed in 74.0.0 · NVD
  30. Medium 5.3

    CVE-2018-20886 · cPanel & WHM

    cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).

    Published 1 Aug 2019 · Fixed in 70.0.53, 72.0.10, 74.0.0 · NVD
  31. Low 2.7

    CVE-2015-7559 · Apache ActiveMQ

    It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.

    Published 1 Aug 2019 · Fixed in 5.14.5, 5.15.5 · NVD
  32. Medium 5.3

    CVE-2018-20885 · cPanel & WHM

    cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).

    Published 1 Aug 2019 · Fixed in 74.0.0 · NVD
  33. Medium 5.4

    CVE-2018-20884 · cPanel & WHM

    cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

    Published 1 Aug 2019 · Fixed in 74.0.0 · NVD
  34. Medium 6.5

    CVE-2018-20883 · cPanel & WHM

    cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  35. Medium 6.8

    CVE-2018-20882 · cPanel & WHM

    cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447).

    Published 1 Aug 2019 · Fixed in 70.0.57, 74.0.8 · NVD
  36. Medium 5.4

    CVE-2018-20881 · cPanel & WHM

    cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  37. Low 3.3

    CVE-2018-20880 · cPanel & WHM

    cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  38. Medium 6.3

    CVE-2018-20879 · cPanel & WHM

    cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  39. Medium 5.4

    CVE-2018-20878 · cPanel & WHM

    cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  40. Medium 5.4

    CVE-2018-20877 · cPanel & WHM

    cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  41. Medium 5.4

    CVE-2018-20876 · cPanel & WHM

    cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  42. Medium 5.4

    CVE-2018-20875 · cPanel & WHM

    cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).

    Published 1 Aug 2019 · Fixed in 74.0.8 · NVD
  43. Medium 5.4

    CVE-2018-20874 · cPanel & WHM

    cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).

    Published 1 Aug 2019 · Fixed in 70.0.57, 74.0.8 · NVD
  44. Low 3.3

    CVE-2018-20873 · cPanel & WHM

    cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).

    Published 1 Aug 2019 · Fixed in 70.0.57, 74.0.8 · NVD
  45. Medium 4.3

    CVE-2019-10189 · Moodle

    A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.

    Published 31 Jul 2019 · Fixed in 3.5.7, 3.6.5, 3.7.1 · NVD
  46. Medium 4.3

    CVE-2019-10188 · Moodle

    A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.

    Published 31 Jul 2019 · Fixed in 3.5.7, 3.6.5, 3.7.1 · NVD
  47. Medium 4.3

    CVE-2019-10187 · Moodle

    A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.

    Published 31 Jul 2019 · Fixed in 3.5.7, 3.6.5, 3.7.1 · NVD
  48. High 8.8

    CVE-2019-10186 · Moodle

    A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.

    Published 31 Jul 2019 · Fixed in 3.5.7, 3.6.5, 3.7.1 · NVD
  49. High 7.5

    CVE-2018-16860 · Samba

    A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively…

    Published 31 Jul 2019 · Fixed in 4.8.12, 4.9.8, 4.10.3 · NVD
  50. Medium 4.9

    CVE-2019-7616 · Kibana

    Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.

    Published 30 Jul 2019 · Fixed in 6.8.2, 7.2.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.