Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,911
- Published in 7 days
- 1,025
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,911 vulnerabilities- High 7.5
CVE-2019-9220 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resource Consumption.
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Low 3.7
CVE-2019-9219 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Critical 9.8
CVE-2019-9217 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Misrepresentation of Critical Information.
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Low 3.7
CVE-2019-9179 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 5 of 5).
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 5.3
CVE-2019-9178 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 4 of 5).
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 6.5
CVE-2019-9176 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF.
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 5.3
CVE-2019-9175 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 3 of 5).
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Critical 10.0
CVE-2019-9174 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 5.9
CVE-2019-9172 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 2 of 5).
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Low 3.7
CVE-2019-9171 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 1 of 5).
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 5.3
CVE-2019-9170 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.
Published 17 Apr 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD - Medium 6.5
CVE-2019-7155 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group.
Published 16 Apr 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD - Critical 9.8
CVE-2018-19971 · JFrog Artifactory
JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.
Published 16 Apr 2019 · NVD - Medium 5.9
CVE-2019-5520 · VMware ESXi
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds read vulnerability. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead…
Published 15 Apr 2019 · NVD - Medium 6.8
CVE-2019-5517 · VMware ESXi
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain multiple out-of-bounds read vulnerabilities in the shader translator. Exploitation of these issues requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful…
Published 15 Apr 2019 · NVD - Medium 6.8
CVE-2019-5516 · VMware ESXi
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds vulnerability with the vertex shader functionality. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful…
Published 15 Apr 2019 · NVD - Critical 9.8
CVE-2019-6609 · F5 BIG-IP
Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key.…
Published 15 Apr 2019 · Fixed in 12.1.4.1, 13.1.1.4, 14.1.0.2 · NVD - High 8.1
CVE-2019-0232 · Apache Tomcat
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be…
Published 15 Apr 2019 · NVD - High 8.8
CVE-2019-11229 · Gitea
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
Published 15 Apr 2019 · Fixed in 1.7.6 · NVD - High 7.5
CVE-2019-11228 · Gitea
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.
Published 15 Apr 2019 · Fixed in 1.7.6 · NVD - High 8.1
CVE-2019-11213 · Ivanti Connect Secure
In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. (The endpoint would need to be already compromised for exploitation to succeed.) This affects Pulse Desktop Client 5.x before Secure Desktop 5.3R7 and Pulse Desktop Client 9.x…
Published 12 Apr 2019 · Fixed in 9.0r3 · NVD - Medium 6.1
CVE-2019-6796 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.
Published 11 Apr 2019 · Fixed in 11.5.8, 11.7.1 · NVD - Medium 6.1
CVE-2018-19202 · MyBB
A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.
Published 11 Apr 2019 · Fixed in 1.8.20 · NVD - Critical 9.8
CVE-2019-9733 · JFrog Artifactory
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default…
Published 11 Apr 2019 · NVD - Critical 9.8
CVE-2019-5715 · Silverstripe CMS
All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.
Published 11 Apr 2019 · Fixed in 4.0.7, 4.1.5, 4.2.4 · NVD - High 8.6
CVE-2019-6610 · F5 BIG-IP
On BIG-IP versions 14.0.0-14.0.0.4, 13.0.0-13.1.1.1, 12.1.0-12.1.4, 11.6.0-11.6.3.4, and 11.5.1-11.5.8, the system is vulnerable to a denial of service attack when performing URL classification.
Published 11 Apr 2019 · NVD - Critical 9.8
CVE-2019-11072 · lighttpd
lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in…
Published 10 Apr 2019 · NVD - High 8.1
CVE-2019-3943 · MikroTik RouterOS
MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Winbox interfaces. An authenticated, remote attack can use this vulnerability to read and write files outside of the sandbox directory (/rw/disk).
Published 10 Apr 2019 · NVD - High 8.8
CVE-2019-11071 · SPIP
SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.
Published 10 Apr 2019 · Fixed in 3.1.10, 3.2.4 · NVD - Medium 5.4
CVE-2019-1003050 · Jenkins
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
Published 10 Apr 2019 · NVD - High 8.1
CVE-2019-1003049 · Jenkins
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Published 10 Apr 2019 · NVD - Critical 9.8
CVE-2019-11068 · Java
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
Published 10 Apr 2019 · NVD - High 8.8
CVE-2019-0229 · Apache Airflow
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
Published 10 Apr 2019 · NVD - Medium 4.8
CVE-2019-0216 · Apache Airflow
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Published 10 Apr 2019 · NVD - Medium 5.5
CVE-2006-7254 · GNU C Library
The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a denial of service attack on the daemon.
Published 10 Apr 2019 · Fixed in 2.5 · NVD - Critical 9.8
CVE-2005-3590 · GNU C Library
The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.
Published 10 Apr 2019 · Fixed in 2.3.5 · NVD - High 7.5
CVE-2019-10946 · Joomla!
An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.
Published 10 Apr 2019 · NVD - Critical 9.8
CVE-2019-10945 · Joomla!
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.
Published 10 Apr 2019 · NVD - Critical 9.8
CVE-2019-7139 · Magento / Adobe Commerce
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Published 10 Apr 2019 · Fixed in 2.1.17, 2.2.8, 2.3.1 · NVD - High 8.1
CVE-2019-6287 · Rancher
In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.
Published 10 Apr 2019 · NVD - High 7.5
CVE-2019-0199 · Apache Tomcat
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to…
Published 10 Apr 2019 · NVD - High 8.8
CVE-2018-20321 · Rancher
An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access.…
Published 10 Apr 2019 · NVD - Medium 6.1
CVE-2019-0858 · Microsoft Exchange Server
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.
Published 9 Apr 2019 · NVD - Medium 5.4
CVE-2019-0817 · Microsoft Exchange Server
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0858.
Published 9 Apr 2019 · NVD - High 7.5
CVE-2019-0815 · .NET
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
Published 9 Apr 2019 · NVD - Medium 6.1
CVE-2018-1356 · Fortinet FortiSandbox
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter in the file scan component.
Published 9 Apr 2019 · Fixed in 3.0.0 · NVD - Medium 5.3
CVE-2018-13366 · Fortinet FortiOS
An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection control setup packets of PPTP protocol.
Published 9 Apr 2019 · NVD - Medium 5.4
CVE-2019-3880 · Samba
A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.
Published 9 Apr 2019 · Fixed in 4.8.11, 4.9.6, 4.10.2 · NVD - Medium 6.1
CVE-2019-3870 · Samba
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default…
Published 9 Apr 2019 · Fixed in 4.9.6, 4.10.2 · NVD - High 8.8
CVE-2018-15640 · Odoo
Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.
Published 9 Apr 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.