UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,889
Published in 7 days
1,003
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,889 vulnerabilities
  1. Medium 5.9

    CVE-2019-7614 · Elasticsearch

    A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.

    Published 30 Jul 2019 · Fixed in 6.8.2, 7.2.1 · NVD
  2. Medium 4.6

    CVE-2019-5451 · Nextcloud

    Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time.

    Published 30 Jul 2019 · Fixed in 3.6.1 · NVD
  3. Medium 4.3

    CVE-2019-5449 · Nextcloud

    A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events.

    Published 30 Jul 2019 · Fixed in 15.0.1 · NVD
  4. Low 3.3

    CVE-2019-1552 · OpenSSL

    OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are…

    Published 30 Jul 2019 · NVD
  5. Critical 9.8

    CVE-2019-11202 · Rancher

    An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be…

    Published 30 Jul 2019 · NVD
  6. Medium 4.3

    CVE-2019-10130 · PostgreSQL

    A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting…

    Published 30 Jul 2019 · Fixed in 9.6.13, 10.8, 11.3 · NVD
  7. Medium 6.5

    CVE-2019-10129 · PostgreSQL

    A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).

    Published 30 Jul 2019 · Fixed in 11.3 · NVD
  8. Low 3.3

    CVE-2019-14414 · cPanel & WHM

    In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  9. Medium 4.3

    CVE-2019-14413 · cPanel & WHM

    cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  10. Low 3.3

    CVE-2019-14412 · cPanel & WHM

    Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  11. Medium 5.3

    CVE-2019-14411 · cPanel & WHM

    cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  12. Low 3.3

    CVE-2019-14410 · cPanel & WHM

    Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  13. Medium 5.5

    CVE-2019-14409 · cPanel & WHM

    cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  14. Medium 4.3

    CVE-2019-14408 · cPanel & WHM

    cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  15. Low 2.7

    CVE-2019-14407 · cPanel & WHM

    cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).

    Published 30 Jul 2019 · Fixed in 78.0.2 · NVD
  16. Medium 6.1

    CVE-2019-14406 · cPanel & WHM

    cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  17. High 8.8

    CVE-2019-14405 · cPanel & WHM

    cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  18. Medium 5.5

    CVE-2019-14404 · cPanel & WHM

    cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  19. Medium 4.3

    CVE-2019-14403 · cPanel & WHM

    cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  20. Low 3.3

    CVE-2019-14402 · cPanel & WHM

    cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  21. High 8.8

    CVE-2019-14401 · cPanel & WHM

    cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  22. High 7.8

    CVE-2019-14400 · cPanel & WHM

    cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  23. High 7.1

    CVE-2019-14399 · cPanel & WHM

    The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).

    Published 30 Jul 2019 · Fixed in 78.0.18 · NVD
  24. High 8.8

    CVE-2019-14398 · cPanel & WHM

    cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).

    Published 30 Jul 2019 · Fixed in 80.0.5 · NVD
  25. Medium 5.3

    CVE-2019-14397 · cPanel & WHM

    cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).

    Published 30 Jul 2019 · Fixed in 80.0.5 · NVD
  26. Low 3.3

    CVE-2019-14396 · cPanel & WHM

    API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).

    Published 30 Jul 2019 · Fixed in 80.0.5 · NVD
  27. Low 3.3

    CVE-2019-14395 · cPanel & WHM

    cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).

    Published 30 Jul 2019 · Fixed in 80.0.5 · NVD
  28. Medium 5.5

    CVE-2019-14394 · cPanel & WHM

    cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).

    Published 30 Jul 2019 · Fixed in 80.0.5 · NVD
  29. Medium 5.3

    CVE-2019-14393 · cPanel & WHM

    cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).

    Published 30 Jul 2019 · Fixed in 80.0.5 · NVD
  30. Medium 5.5

    CVE-2018-20870 · cPanel & WHM

    The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  31. High 7.8

    CVE-2018-20869 · cPanel & WHM

    cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  32. Medium 6.1

    CVE-2018-20868 · cPanel & WHM

    cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  33. Medium 6.1

    CVE-2018-20866 · cPanel & WHM

    cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  34. Medium 6.1

    CVE-2018-20865 · cPanel & WHM

    cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  35. Medium 6.5

    CVE-2018-20864 · cPanel & WHM

    cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  36. Critical 9.8

    CVE-2018-20863 · cPanel & WHM

    cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  37. High 7.8

    CVE-2018-20862 · cPanel & WHM

    cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  38. High 8.8

    CVE-2019-14392 · cPanel & WHM

    cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).

    Published 30 Jul 2019 · Fixed in 80.0.22 · NVD
  39. Medium 6.1

    CVE-2018-20867 · cPanel & WHM

    cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).

    Published 30 Jul 2019 · Fixed in 76.0.8 · NVD
  40. Low 3.3

    CVE-2019-14391 · cPanel & WHM

    cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).

    Published 30 Jul 2019 · Fixed in 82.0.2 · NVD
  41. Medium 5.4

    CVE-2019-14390 · cPanel & WHM

    cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).

    Published 30 Jul 2019 · Fixed in 82.0.2 · NVD
  42. High 7.8

    CVE-2019-14389 · cPanel & WHM

    cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).

    Published 30 Jul 2019 · Fixed in 82.0.2 · NVD
  43. High 7.5

    CVE-2019-14388 · cPanel & WHM

    cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).

    Published 30 Jul 2019 · Fixed in 82.0.2 · NVD
  44. Medium 6.1

    CVE-2019-14387 · cPanel & WHM

    cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).

    Published 30 Jul 2019 · Fixed in 82.0.2 · NVD
  45. Medium 5.4

    CVE-2019-14386 · cPanel & WHM

    cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).

    Published 30 Jul 2019 · Fixed in 82.0.2 · NVD
  46. Critical 9.8

    CVE-2019-14271 · Docker Engine

    In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.

    Published 29 Jul 2019 · Fixed in 19.03.1 · NVD
  47. High 8.0

    CVE-2019-11201 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the…

    Published 29 Jul 2019 · NVD
  48. High 8.8

    CVE-2019-11200 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)

    Published 29 Jul 2019 · NVD
  49. Medium 5.4

    CVE-2019-11199 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output…

    Published 29 Jul 2019 · NVD
  50. High 7.3

    CVE-2019-1020018 · Discourse

    Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.

    Published 29 Jul 2019 · Fixed in 2.3.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.