UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,911
Published in 7 days
1,018
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,911 vulnerabilities
  1. Medium 6.1

    CVE-2018-15635 · Odoo

    Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a crafted name.

    Published 9 Apr 2019 · NVD
  2. Medium 6.5

    CVE-2018-15631 · Odoo

    Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request.

    Published 9 Apr 2019 · NVD
  3. High 7.2

    CVE-2017-17544 · Fortinet FortiOS

    A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to super_admin via restoring modified configurations.

    Published 9 Apr 2019 · NVD
  4. High 7.8Actively exploited

    CVE-2019-0211 · Apache HTTP Server

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

    Published 8 Apr 2019 · NVD
  5. High 7.5

    CVE-2019-0217 · Apache HTTP Server

    In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

    Published 8 Apr 2019 · NVD
  6. Medium 5.5

    CVE-2019-1798 · ClamAV

    A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit…

    Published 8 Apr 2019 · NVD
  7. Medium 5.5

    CVE-2019-1788 · ClamAV

    A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker…

    Published 8 Apr 2019 · NVD
  8. High 7.5

    CVE-2019-0215 · Apache HTTP Server

    In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

    Published 8 Apr 2019 · NVD
  9. Medium 5.5

    CVE-2019-1787 · ClamAV

    A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an…

    Published 8 Apr 2019 · NVD
  10. Medium 5.5

    CVE-2019-1786 · ClamAV

    A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an…

    Published 8 Apr 2019 · NVD
  11. High 7.8

    CVE-2019-1785 · ClamAV

    A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this…

    Published 8 Apr 2019 · NVD
  12. Medium 4.3

    CVE-2019-10740 · Roundcube

    In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they…

    Published 7 Apr 2019 · Fixed in 1.3.10 · NVD
  13. High 8.8

    CVE-2019-10867 · Pimcore

    An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

    Published 4 Apr 2019 · Fixed in 5.7.1 · NVD
  14. High 7.5

    CVE-2018-20229 · GitLab

    GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal.

    Published 4 Apr 2019 · Fixed in 11.3.14, 11.4.12, 11.5.5 · NVD
  15. High 8.1

    CVE-2018-20506 · SQLite

    SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different…

    Published 3 Apr 2019 · Fixed in 3.25.3 · NVD
  16. High 7.5

    CVE-2018-20505 · SQLite

    SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

    Published 3 Apr 2019 · NVD
  17. Medium 6.5

    CVE-2019-10714 · ImageMagick

    LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.

    Published 2 Apr 2019 · Fixed in 6.9.10-32, 7.0.8-32 · NVD
  18. High 7.5

    CVE-2019-9946 · Kubernetes

    Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if…

    Published 2 Apr 2019 · Fixed in 1.11.9, 1.12.7, 1.13.5 · NVD
  19. High 7.5

    CVE-2019-7477 · SonicWall SonicOS

    A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv…

    Published 2 Apr 2019 · NVD
  20. Critical 9.8

    CVE-2019-7475 · SonicWall SonicOS

    A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing services. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE),…

    Published 2 Apr 2019 · NVD
  21. Medium 6.5

    CVE-2019-7474 · SonicWall SonicOS

    A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate with specific extension. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE),…

    Published 2 Apr 2019 · NVD
  22. Medium 6.5

    CVE-2019-4080 · IBM WebSphere Application Server

    IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper parameter parsing. A remote attacker could exploit this to consume all available CPU resources. IBM X-Force ID: 157380.

    Published 2 Apr 2019 · NVD
  23. High 7.2

    CVE-2019-9193 · PostgreSQL

    In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an…

    Published 1 Apr 2019 · NVD
  24. Medium 6.8

    CVE-2019-5519 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain a Time-of-check Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to…

    Published 1 Apr 2019 · NVD
  25. Medium 6.8

    CVE-2019-5518 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain an out-of-bounds read/write vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual…

    Published 1 Apr 2019 · NVD
  26. Medium 5.5

    CVE-2019-1002101 · Kubernetes

    The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to…

    Published 1 Apr 2019 · Fixed in 1.11.9, 1.12.7, 1.13.5 · NVD
  27. Medium 6.5

    CVE-2019-1002100 · Kubernetes

    In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

    Published 1 Apr 2019 · Fixed in 1.11.8, 1.12.6, 1.13.4 · NVD
  28. High 7.5

    CVE-2019-6715 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 Apr 2019 · Fixed in 0.9.4 · WPVulnerability
  29. High 8.1

    CVE-2019-10650 · ImageMagick

    In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.

    Published 30 Mar 2019 · NVD
  30. Medium 5.5

    CVE-2019-10649 · ImageMagick

    In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.

    Published 30 Mar 2019 · NVD
  31. Medium 6.1

    CVE-2018-19201 · MyBB

    A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter.

    Published 29 Mar 2019 · Fixed in 1.8.20 · NVD
  32. High 7.5

    CVE-2019-0222 · Apache ActiveMQ

    In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

    Published 28 Mar 2019 · NVD
  33. Medium 5.9

    CVE-2019-6608 · F5 BIG-IP

    On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-IP vCMP guest when processing authorized SNMP requests.

    Published 28 Mar 2019 · NVD
  34. Medium 4.3

    CVE-2019-6606 · F5 BIG-IP

    On BIG-IP 11.5.1-11.6.3.4, 12.1.0-12.1.3.7, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, when processing certain SNMP requests with a request-id of 0, the snmpd process may leak a small amount of memory.

    Published 28 Mar 2019 · NVD
  35. High 7.5

    CVE-2019-6605 · F5 BIG-IP

    On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, and 12.0.x, an undisclosed sequence of packets received by an SSL virtual server and processed by an associated Client SSL or Server SSL profile may cause a denial of service.

    Published 28 Mar 2019 · Fixed in 11.5.9, 11.6.4, 12.1.0 · NVD
  36. Medium 6.8

    CVE-2019-6604 · F5 BIG-IP

    On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems with a High-Speed Bridge and using non-default Layer 2 forwarding configurations may experience a lockup of the High-Speed Bridge.

    Published 28 Mar 2019 · NVD
  37. High 7.5

    CVE-2019-6603 · F5 BIG-IP

    In BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, and 13.0.0-13.0.1, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of service. The control plane is not exposed to this issue. This issue impacts the data plane virtual servers and self IPs.

    Published 28 Mar 2019 · NVD
  38. High 7.5

    CVE-2019-6602 · F5 BIG-IP

    In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request.

    Published 28 Mar 2019 · NVD
  39. Medium 6.1

    CVE-2019-9167 · Nagios XI

    Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter.

    Published 28 Mar 2019 · Fixed in 5.5.11 · NVD
  40. High 7.8

    CVE-2019-9166 · Nagios XI

    Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php.

    Published 28 Mar 2019 · Fixed in 5.5.11 · NVD
  41. Critical 9.8

    CVE-2019-9165 · Nagios XI

    SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.

    Published 28 Mar 2019 · Fixed in 5.5.11 · NVD
  42. High 8.8

    CVE-2019-9164 · Nagios XI

    Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.

    Published 28 Mar 2019 · Fixed in 5.5.11 · NVD
  43. High 7.5

    CVE-2019-5739 · Node.js

    Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.

    Published 28 Mar 2019 · NVD
  44. High 7.5

    CVE-2019-5737 · Node.js

    In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer…

    Published 28 Mar 2019 · Fixed in 8.15.1, 10.15.2, 11.10.1 · NVD
  45. High 7.5

    CVE-2018-20144 · GitLab

    GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.

    Published 28 Mar 2019 · Fixed in 11.3.13, 11.4.11, 11.5.4 · NVD
  46. High 7.8

    CVE-2019-7524 · Dovecot

    In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.

    Published 28 Mar 2019 · Fixed in 2.2.36.3, 2.3.5.1 · NVD
  47. High 7.5

    CVE-2018-12545 · Eclipse Jetty

    In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

    Published 27 Mar 2019 · NVD
  48. High 8.1

    CVE-2019-10233 · GLPI

    Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.

    Published 27 Mar 2019 · Fixed in 9.4.1.1 · NVD
  49. Critical 9.8

    CVE-2018-19466 · Portainer

    A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls.

    Published 27 Mar 2019 · Fixed in 1.20.0 · NVD
  50. Medium 4.8

    CVE-2019-3847 · Moodle

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.

    Published 27 Mar 2019 · Fixed in 3.4.8, 3.5.5, 3.6.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.