Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,908
- Published in 7 days
- 1,022
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,908 vulnerabilities- Medium 6.1
CVE-2019-10133 · Moodle
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
Published 26 Jun 2019 · NVD - High 7.8
CVE-2019-12979 · ImageMagick
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.
Published 26 Jun 2019 · NVD - High 7.8
CVE-2019-12978 · ImageMagick
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.
Published 26 Jun 2019 · NVD - High 7.8
CVE-2019-12977 · ImageMagick
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.
Published 26 Jun 2019 · NVD - Medium 5.5
CVE-2019-12976 · ImageMagick
ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c.
Published 26 Jun 2019 · NVD - Medium 5.5
CVE-2019-12975 · ImageMagick
ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
Published 26 Jun 2019 · NVD - Medium 5.5
CVE-2019-12974 · ImageMagick
A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image.
Published 26 Jun 2019 · NVD - Medium 6.5
CVE-2019-11583 · Jira
The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name".
Published 26 Jun 2019 · Fixed in 8.1.0 · NVD - High 8.8
CVE-2019-10164 · PostgreSQL
PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
Published 26 Jun 2019 · Fixed in 10.9, 11.4 · NVD - Medium 6.1
CVE-2019-12949 · pfSense
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server.
Published 25 Jun 2019 · NVD - Unrated
WPV-d171dacac5c5 · SEO By Rank Math (WordPress plugin)
Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Published 25 Jun 2019 · Fixed in 1.0.27.1 · WPVulnerability - High 7.5
CVE-2018-20843 · Expat
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
Published 24 Jun 2019 · Fixed in 2.2.7 · NVD - Medium 6.1
CVE-2019-12935 · Shopware
Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.
Published 23 Jun 2019 · Fixed in 5.5.8 · NVD - High 7.5
CVE-2019-10072 · Apache Tomcat
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Published 21 Jun 2019 · NVD - Medium 6.5
CVE-2019-14786 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization
Published 21 Jun 2019 · Fixed in 1.0.27.1 · WPVulnerability - Critical 9.8
CVE-2019-2729 · Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle…
Published 19 Jun 2019 · NVD - Critical 9.8
CVE-2019-12900 · Python
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Published 19 Jun 2019 · Fixed in 3.8.13, 3.9.11, 3.10.3 · NVD - Critical 9.8
CVE-2018-17148 · Nagios XI
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.
Published 19 Jun 2019 · Fixed in 5.5.4 · NVD - Medium 5.4
CVE-2018-17146 · Nagios XI
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.
Published 19 Jun 2019 · Fixed in 5.5.4 · NVD - Medium 6.5
CVE-2019-12436 · Samba
Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit.
Published 19 Jun 2019 · Fixed in 4.10.5 · NVD - Medium 6.5
CVE-2019-12435 · Samba
Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management server (dnsserver) RPC server process.
Published 19 Jun 2019 · Fixed in 4.9.9, 4.10.5 · NVD - High 7.5
CVE-2019-11479 · F5 BIG-IP
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits…
Published 19 Jun 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.0.1.1 · NVD - High 7.5
CVE-2019-11478 · F5 BIG-IP
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit…
Published 19 Jun 2019 · NVD - High 7.5
CVE-2019-11477 · F5 BIG-IP
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
Published 19 Jun 2019 · NVD - Critical 9.1
CVE-2019-11040 · PHP
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Published 19 Jun 2019 · Fixed in 7.1.30, 7.2.19, 7.3.6 · NVD - Critical 9.1
CVE-2019-11039 · PHP
Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
Published 19 Jun 2019 · Fixed in 7.1.30, 7.2.19, 7.3.6 · NVD - Medium 5.3
CVE-2019-11038 · PHP
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Published 19 Jun 2019 · Fixed in 7.1.30, 7.2.19, 7.3.6 · NVD - Medium 6.1
CVE-2019-12823 · Craft CMS
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
Published 18 Jun 2019 · Fixed in 3.1.31 · NVD - Unrated
WPV-d318cf3b79ed · SEO By Rank Math (WordPress plugin)
Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Published 18 Jun 2019 · Fixed in 1.0.27 · WPVulnerability - Unrated
WPV-49859c410c18 · SEO By Rank Math (WordPress plugin)
Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Published 18 Jun 2019 · Fixed in 1.0.27 · WPVulnerability - Medium 6.5
CVE-2018-18958 · OPNsense
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
Published 17 Jun 2019 · Fixed in 18.7.7 · NVD - Medium 4.8
CVE-2018-19146 · Concrete CMS
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.
Published 17 Jun 2019 · NVD - High 8.8
CVE-2019-12840 · Webmin
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
Published 15 Jun 2019 · NVD - High 7.2
CVE-2019-12831 · MyBB
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme…
Published 15 Jun 2019 · Fixed in 1.8.21 · NVD - High 8.7
CVE-2019-12830 · MyBB
In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue.
Published 15 Jun 2019 · Fixed in 1.8.21 · NVD - High 8.8
CVE-2019-12799 · Shopware
In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
Published 13 Jun 2019 · NVD - Critical 9.8
CVE-2019-7840 · Adobe ColdFusion
ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Published 12 Jun 2019 · NVD - Critical 9.8
CVE-2019-7839 · Adobe ColdFusion
ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
Published 12 Jun 2019 · NVD - Critical 9.8
CVE-2019-7838 · Adobe ColdFusion
ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
Published 12 Jun 2019 · NVD - Medium 4.2
CVE-2019-0197 · Apache HTTP Server
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on"…
Published 11 Jun 2019 · NVD - Medium 5.3
CVE-2019-0196 · Apache HTTP Server
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.
Published 11 Jun 2019 · NVD - Critical 9.1
CVE-2019-12146 · WS_FTP Server
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.
Published 11 Jun 2019 · Fixed in 8.6.1 · NVD - High 7.5
CVE-2019-12145 · WS_FTP Server
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system.
Published 11 Jun 2019 · Fixed in 8.6.1 · NVD - Critical 9.8
CVE-2019-12144 · WS_FTP Server
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature.
Published 11 Jun 2019 · Fixed in 8.6.1 · NVD - Medium 5.3
CVE-2019-12143 · WS_FTP Server
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose WS_FTP usernames as well as filenames.
Published 11 Jun 2019 · Fixed in 8.6.1 · NVD - Medium 5.3
CVE-2019-0220 · Apache HTTP Server
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
Published 11 Jun 2019 · NVD - Medium 6.1
CVE-2019-12766 · Joomla!
An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors.
Published 11 Jun 2019 · NVD - Critical 9.8
CVE-2019-12765 · Joomla!
An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
Published 11 Jun 2019 · NVD - Medium 6.5
CVE-2019-12764 · Joomla!
An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.
Published 11 Jun 2019 · Fixed in 3.9.7 · NVD - Medium 4.7
CVE-2019-11881 · Rancher
A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special characters or symbols. There's no other limitation of the message, allowing malicious users to lure legitimate users to visit phishing sites with scare tactics, e.g., displaying a "This version of Rancher is outdated,…
Published 10 Jun 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.