Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,901
- Published in 7 days
- 1,015
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,901 vulnerabilities- High 7.5
CVE-2019-6629 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restart. The Client SSL profile must have session tickets enabled and use DHE cipher suites to be affected. This only impacts the data plane, there is no impact to the control plane.
Published 3 Jul 2019 · NVD - Medium 6.1
CVE-2019-6625 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI) also known as the BIG-IP Configuration utility.
Published 3 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD - Medium 4.3
CVE-2018-14866 · Odoo
Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.
Published 3 Jul 2019 · NVD - High 7.5
CVE-2018-18326 · DNN Platform
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.
Published 3 Jul 2019 · NVD - High 7.5Actively exploited
CVE-2018-18325 · DNN Platform
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Published 3 Jul 2019 · NVD - High 7.5
CVE-2018-15812 · DNN Platform
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
Published 3 Jul 2019 · NVD - High 7.5Actively exploited
CVE-2018-15811 · DNN Platform
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Published 3 Jul 2019 · NVD - High 7.5
CVE-2019-6623 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, undisclosed traffic sent to BIG-IP iSession virtual server may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
Published 2 Jul 2019 · NVD - High 7.5
CVE-2019-6624 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, an undisclosed traffic pattern sent to a BIG-IP UDP virtual server may lead to a denial-of-service (DoS).
Published 2 Jul 2019 · NVD - High 7.2
CVE-2019-6622 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems.
Published 2 Jul 2019 · NVD - High 7.2
CVE-2019-6621 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.0, and 5.1.0-5.4.0, an undisclosed iControl REST worker is vulnerable to command injection by an admin/resource admin user. This issue impacts both iControl REST and tmsh implementations.
Published 2 Jul 2019 · Fixed in 13.1.1.5, 14.0.0.5, 14.1.0.6 · NVD - High 7.2
CVE-2019-6620 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed iControl REST worker vulnerable to command injection for an Administrator user.
Published 2 Jul 2019 · Fixed in 13.1.1.5, 14.1.0.6 · NVD - High 7.8
CVE-2019-5443 · curl, MySQL
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Published 2 Jul 2019 · NVD - High 8.8
CVE-2019-13056 · CyberPanel
An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of CSRF protection.
Published 2 Jul 2019 · NVD - Unrated
WPV-8230d792f3ee · WooCommerce
Vulnerability in WooCommerce
Published 2 Jul 2019 · Fixed in 3.6.5 · WPVulnerability - Unrated
WPV-15af68f3cd59 · WooCommerce
Vulnerability in WooCommerce
Published 2 Jul 2019 · Fixed in 3.6.5 · WPVulnerability - High 8.8
CVE-2019-6642 · F5 BIG-IP
In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a…
Published 1 Jul 2019 · NVD - Medium 6.5
CVE-2019-13137 · ImageMagick
ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c.
Published 1 Jul 2019 · Fixed in 6.9.10-50, 7.0.8-50 · NVD - High 7.8
CVE-2019-13136 · ImageMagick
ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.
Published 1 Jul 2019 · Fixed in 7.0.8-50 · NVD - High 8.8
CVE-2019-13135 · ImageMagick
ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
Published 1 Jul 2019 · Fixed in 6.9.10-50, 7.0.8-50 · NVD - Medium 5.5
CVE-2019-13134 · ImageMagick
ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c.
Published 1 Jul 2019 · Fixed in 7.0.8-50 · NVD - Medium 5.5
CVE-2019-13133 · ImageMagick
ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
Published 1 Jul 2019 · Fixed in 7.0.8-50 · NVD - Medium 5.3
CVE-2019-13118 · Java
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
Published 1 Jul 2019 · NVD - Medium 5.3
CVE-2019-13117 · Java
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
Published 1 Jul 2019 · NVD - Critical 9.8
CVE-2019-13082 · Chamilo LMS
Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive, the server will accept this file without any checks. Because…
Published 30 Jun 2019 · NVD - Medium 5.4
CVE-2019-13068 · Grafana
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
Published 30 Jun 2019 · Fixed in 6.2.5 · NVD - Medium 6.1
CVE-2018-20814 · Ivanti Connect Secure
An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX.
Published 28 Jun 2019 · NVD - Critical 9.8
CVE-2018-20813 · Ivanti Connect Secure
An input validation issue has been found with login_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2.
Published 28 Jun 2019 · NVD - Medium 5.3
CVE-2018-20811 · Ivanti Connect Secure
A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12.
Published 28 Jun 2019 · NVD - Critical 9.8
CVE-2018-20810 · Ivanti Connect Secure
Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices.
Published 28 Jun 2019 · NVD - High 7.5
CVE-2018-20809 · Ivanti Connect Secure
A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5. This is not applicable to PCS 8.1RX.
Published 28 Jun 2019 · NVD - Medium 6.1
CVE-2018-20808 · Ivanti Connect Secure
An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX.
Published 28 Jun 2019 · NVD - Medium 6.1
CVE-2018-20807 · Ivanti Connect Secure
An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly.
Published 28 Jun 2019 · NVD - Medium 6.5
CVE-2018-14887 · Odoo
Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request.
Published 28 Jun 2019 · NVD - Medium 4.9
CVE-2018-14886 · Odoo
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
Published 28 Jun 2019 · NVD - Critical 9.8
CVE-2018-14885 · Odoo
Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds.
Published 28 Jun 2019 · NVD - Medium 6.5
CVE-2018-14868 · Odoo
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
Published 28 Jun 2019 · NVD - Medium 5.3
CVE-2018-14867 · Odoo
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Published 28 Jun 2019 · NVD - High 7.5
CVE-2019-4269 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack trace to be dumped. IBM X-Force ID: 160202.
Published 28 Jun 2019 · NVD - Unrated
WPV-6e89637e6d14 · Webp Converter For Media (WordPress plugin)
Vulnerability in Converter for Media – Optimize images | Convert WebP & AVIF
Published 27 Jun 2019 · Fixed in 1.0.3 · WPVulnerability - High 8.8
CVE-2019-15834 · Webp Converter For Media (WordPress plugin)
Converter for Media – Optimize images | Convert WebP & AVIF: Cross-Site Request Forgery (CSRF)
Published 27 Jun 2019 · Fixed in 1.0.3 · WPVulnerability - High 7.5
CVE-2019-10154 · Moodle
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
Published 26 Jun 2019 · Fixed in 3.6.4 · NVD - Low 3.7
CVE-2019-10134 · Moodle
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
Published 26 Jun 2019 · NVD - Medium 6.1
CVE-2019-10133 · Moodle
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
Published 26 Jun 2019 · NVD - High 7.8
CVE-2019-12979 · ImageMagick
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.
Published 26 Jun 2019 · NVD - High 7.8
CVE-2019-12978 · ImageMagick
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.
Published 26 Jun 2019 · NVD - High 7.8
CVE-2019-12977 · ImageMagick
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.
Published 26 Jun 2019 · NVD - Medium 5.5
CVE-2019-12976 · ImageMagick
ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c.
Published 26 Jun 2019 · NVD - Medium 5.5
CVE-2019-12975 · ImageMagick
ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
Published 26 Jun 2019 · NVD - Medium 5.5
CVE-2019-12974 · ImageMagick
A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image.
Published 26 Jun 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.