UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,894
Published in 7 days
1,008
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,894 vulnerabilities
  1. High 7.5

    CVE-2018-14733 · Odoo

    The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) under certain circumstances.

    Published 5 Jul 2019 · NVD
  2. Medium 6.1

    CVE-2019-13345 · Squid

    The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.

    Published 5 Jul 2019 · NVD
  3. High 8.8

    CVE-2019-13312 · FFmpeg

    block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.

    Published 5 Jul 2019 · NVD
  4. Medium 6.5

    CVE-2019-13311 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.

    Published 5 Jul 2019 · NVD
  5. Medium 6.5

    CVE-2019-13310 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c.

    Published 5 Jul 2019 · NVD
  6. Medium 6.5

    CVE-2019-13309 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c.

    Published 5 Jul 2019 · NVD
  7. High 8.8

    CVE-2019-13308 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.

    Published 5 Jul 2019 · NVD
  8. High 7.8

    CVE-2019-13307 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.

    Published 5 Jul 2019 · NVD
  9. High 7.8

    CVE-2019-13306 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.

    Published 5 Jul 2019 · NVD
  10. High 7.8

    CVE-2019-13305 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.

    Published 5 Jul 2019 · NVD
  11. High 7.8

    CVE-2019-13304 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.

    Published 5 Jul 2019 · NVD
  12. High 8.8

    CVE-2019-13303 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.

    Published 5 Jul 2019 · NVD
  13. High 8.8

    CVE-2019-13302 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.

    Published 5 Jul 2019 · NVD
  14. Medium 6.5

    CVE-2019-13301 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.

    Published 5 Jul 2019 · NVD
  15. High 8.8

    CVE-2019-13300 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.

    Published 5 Jul 2019 · NVD
  16. High 8.8

    CVE-2019-13299 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.

    Published 5 Jul 2019 · NVD
  17. High 8.8

    CVE-2019-13298 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error.

    Published 5 Jul 2019 · NVD
  18. High 8.8

    CVE-2019-13297 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.

    Published 5 Jul 2019 · NVD
  19. Medium 6.5

    CVE-2019-13296 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c for a NULL value.

    Published 5 Jul 2019 · NVD
  20. High 8.8

    CVE-2019-13295 · ImageMagick

    ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.

    Published 5 Jul 2019 · NVD
  21. Medium 6.1

    CVE-2019-13239 · GLPI

    inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.

    Published 4 Jul 2019 · Fixed in 9.4.3 · NVD
  22. High 7.5

    CVE-2019-13074 · MikroTik RouterOS

    A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource management.

    Published 3 Jul 2019 · NVD
  23. Medium 4.3

    CVE-2019-12846 · TeamCity

    A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.

    Published 3 Jul 2019 · Fixed in 2018.2.2 · NVD
  24. Medium 5.3

    CVE-2019-12845 · TeamCity

    The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.

    Published 3 Jul 2019 · Fixed in 2018.2.3 · NVD
  25. Medium 6.1

    CVE-2019-12844 · TeamCity

    A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.

    Published 3 Jul 2019 · Fixed in 2018.2.3 · NVD
  26. Medium 6.1

    CVE-2019-12843 · TeamCity

    A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.

    Published 3 Jul 2019 · Fixed in 2018.2.3 · NVD
  27. Medium 6.1

    CVE-2019-12842 · TeamCity

    A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.

    Published 3 Jul 2019 · Fixed in 2018.2.2 · NVD
  28. High 7.5

    CVE-2019-12841 · TeamCity

    Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.

    Published 3 Jul 2019 · Fixed in 2018.2.2 · NVD
  29. Critical 9.1

    CVE-2018-14860 · Odoo

    Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.

    Published 3 Jul 2019 · NVD
  30. High 8.1

    CVE-2018-14859 · Odoo

    Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.

    Published 3 Jul 2019 · NVD
  31. Medium 6.5

    CVE-2019-6641 · F5 BIG-IP

    On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash. The attack can only come from an authenticated user; all roles are capable of performing the attack. Unauthenticated users cannot perform this attack.

    Published 3 Jul 2019 · NVD
  32. Medium 5.3

    CVE-2019-6640 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is inserted into various profile types and accessed using SNMPv2.

    Published 3 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD
  33. Medium 6.5

    CVE-2019-6638 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad process.

    Published 3 Jul 2019 · Fixed in 14.0.0.5, 14.1.0.6 · NVD
  34. Medium 4.4

    CVE-2019-6635 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is licensed for Appliance mode, a user with either the Administrator or the Resource Administrator role can bypass Appliance mode restrictions.

    Published 3 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD
  35. Medium 6.5

    CVE-2019-6634 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in restjavad process. This causes issues with both iControl REST and some portions of TMUI. The attack requires an authenticated user with any role.

    Published 3 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD
  36. Medium 5.5

    CVE-2019-6632 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files.

    Published 3 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD
  37. Medium 6.5

    CVE-2018-14865 · Odoo

    Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.

    Published 3 Jul 2019 · NVD
  38. Medium 6.5

    CVE-2018-14864 · Odoo

    Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment.

    Published 3 Jul 2019 · NVD
  39. High 8.1

    CVE-2018-14863 · Odoo

    Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.

    Published 3 Jul 2019 · NVD
  40. Medium 6.5

    CVE-2018-14862 · Odoo

    Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.

    Published 3 Jul 2019 · NVD
  41. Medium 6.5

    CVE-2018-14861 · Odoo

    Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users.

    Published 3 Jul 2019 · NVD
  42. Medium 4.4

    CVE-2019-6633 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with Appliance mode, user accounts with Administrator and Resource Administrator roles can bypass Appliance mode restrictions.

    Published 3 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD
  43. High 7.5

    CVE-2019-6631 · F5 BIG-IP

    On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs.

    Published 3 Jul 2019 · NVD
  44. High 7.5

    CVE-2019-6629 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restart. The Client SSL profile must have session tickets enabled and use DHE cipher suites to be affected. This only impacts the data plane, there is no impact to the control plane.

    Published 3 Jul 2019 · NVD
  45. Medium 6.1

    CVE-2019-6625 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI) also known as the BIG-IP Configuration utility.

    Published 3 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD
  46. Medium 4.3

    CVE-2018-14866 · Odoo

    Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.

    Published 3 Jul 2019 · NVD
  47. High 7.5

    CVE-2018-18326 · DNN Platform

    DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

    Published 3 Jul 2019 · NVD
  48. High 7.5Actively exploited

    CVE-2018-18325 · DNN Platform

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

    Published 3 Jul 2019 · NVD
  49. High 7.5

    CVE-2018-15812 · DNN Platform

    DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    Published 3 Jul 2019 · NVD
  50. High 7.5Actively exploited

    CVE-2018-15811 · DNN Platform

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    Published 3 Jul 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.