Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,919
- Published in 7 days
- 1,021
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,919 vulnerabilities- High 7.5
CVE-2019-5739 · Node.js
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
Published 28 Mar 2019 · NVD - High 7.5
CVE-2019-5737 · Node.js
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer…
Published 28 Mar 2019 · Fixed in 8.15.1, 10.15.2, 11.10.1 · NVD - High 7.5
CVE-2018-20144 · GitLab
GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
Published 28 Mar 2019 · Fixed in 11.3.13, 11.4.11, 11.5.4 · NVD - High 7.8
CVE-2019-7524 · Dovecot
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
Published 28 Mar 2019 · Fixed in 2.2.36.3, 2.3.5.1 · NVD - High 7.5
CVE-2018-12545 · Eclipse Jetty
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Published 27 Mar 2019 · NVD - High 8.1
CVE-2019-10233 · GLPI
Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
Published 27 Mar 2019 · Fixed in 9.4.1.1 · NVD - Critical 9.8
CVE-2018-19466 · Portainer
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls.
Published 27 Mar 2019 · Fixed in 1.20.0 · NVD - Medium 4.8
CVE-2019-3847 · Moodle
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
Published 27 Mar 2019 · Fixed in 3.4.8, 3.5.5, 3.6.3 · NVD - Medium 6.8
CVE-2019-3814 · Dovecot
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.
Published 27 Mar 2019 · Fixed in 2.2.36.1, 2.3.4.1 · NVD - Medium 6.1
CVE-2019-10118 · Snipe-IT
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
Published 27 Mar 2019 · Fixed in 4.6.14 · NVD - High 7.5
CVE-2019-1572 · Palo Alto Networks PAN-OS
PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
Published 26 Mar 2019 · NVD - Medium 5.4
CVE-2019-6341 · Drupal
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
Published 26 Mar 2019 · Fixed in 7.65, 8.5.14, 8.6.13 · NVD - Medium 4.3
CVE-2019-3852 · Moodle
A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing into account when checking user capabilities
Published 26 Mar 2019 · Fixed in 3.6.3 · NVD - Medium 4.3
CVE-2019-3851 · Moodle
A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page.
Published 26 Mar 2019 · Fixed in 3.5.5, 3.6.3 · NVD - Medium 6.1
CVE-2019-3850 · Moodle
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.
Published 26 Mar 2019 · Fixed in 3.4.8, 3.5.5, 3.6.3 · NVD - High 8.8
CVE-2019-3849 · Moodle
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
Published 26 Mar 2019 · Fixed in 3.4.8, 3.5.5, 3.6.3 · NVD - Medium 4.3
CVE-2019-3848 · Moodle
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)
Published 26 Mar 2019 · Fixed in 3.4.8, 3.5.5, 3.6.3 · NVD - Medium 4.8
CVE-2019-7646 · Control Web Panel
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module parameter.
Published 26 Mar 2019 · NVD - High 7.5
CVE-2018-19856 · GitLab
GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API.
Published 26 Mar 2019 · Fixed in 11.3.12, 11.4.10, 11.5.3 · NVD - High 8.1
CVE-2019-7611 · Elasticsearch
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data…
Published 25 Mar 2019 · Fixed in 5.6.15, 6.6.1 · NVD - Critical 9.0
CVE-2019-7610 · Kibana
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Published 25 Mar 2019 · Fixed in 5.6.15, 6.6.1 · NVD - Critical 10.0Actively exploited
CVE-2019-7609 · Kibana
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Published 25 Mar 2019 · Fixed in 5.6.15, 6.6.1 · NVD - Medium 6.1
CVE-2019-7608 · Kibana
Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Published 25 Mar 2019 · Fixed in 5.6.15, 6.6.1 · NVD - High 7.5
CVE-2019-4046 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory. IBM X-Force ID: 156242.
Published 25 Mar 2019 · Fixed in 19.0.0.4 · NVD - Medium 5.5
CVE-2019-3838 · Ghostscript
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Published 25 Mar 2019 · Fixed in 9.27 · NVD - Medium 5.5
CVE-2019-3835 · Ghostscript
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Published 25 Mar 2019 · Fixed in 9.27 · NVD - Critical 9.8Actively exploited
CVE-2019-3396 · Confluence
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a…
Published 25 Mar 2019 · Fixed in 6.12.3, 6.13.3, 6.14.2 · NVD - Critical 9.8
CVE-2019-3395 · Confluence
The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery.
Published 25 Mar 2019 · Fixed in 6.13.3, 6.14.2 · NVD - Medium 6.1
CVE-2019-3810 · Moodle
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
Published 25 Mar 2019 · NVD - Critical 10.0
CVE-2019-3809 · Moodle
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.
Published 25 Mar 2019 · NVD - Medium 5.4
CVE-2019-3808 · Moodle
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.
Published 25 Mar 2019 · NVD - High 7.5
CVE-2019-6240 · GitLab
An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.
Published 25 Mar 2019 · Fixed in 11.4.0 · NVD - Critical 9.8
CVE-2019-9960 · LimeSurvey
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
Published 24 Mar 2019 · NVD - High 8.8
CVE-2019-9956 · ImageMagick
In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
Published 24 Mar 2019 · NVD - Critical 9.1
CVE-2019-9948 · Python
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Published 23 Mar 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD - Medium 6.1
CVE-2019-9947 · Python
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the…
Published 23 Mar 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD - High 7.5
CVE-2019-9937 · SQLite
In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.
Published 22 Mar 2019 · NVD - High 7.5
CVE-2019-9936 · SQLite
In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.
Published 22 Mar 2019 · NVD - Critical 9.8Actively exploited
CVE-2019-7238 · Sonatype Nexus Repository
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
Published 21 Mar 2019 · Fixed in 3.15.0 · NVD - High 7.5
CVE-2019-6970 · Moodle
Moodle 3.5.x before 3.5.4 allows SSRF.
Published 21 Mar 2019 · Fixed in 3.5.4 · NVD - High 7.8
CVE-2019-6116 · Ghostscript
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
Published 21 Mar 2019 · NVD - High 7.5
CVE-2018-20615 · HAProxy
An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.
Published 21 Mar 2019 · NVD - Medium 5.4
CVE-2018-19191 · Webmin
Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.
Published 21 Mar 2019 · NVD - Medium 6.1
CVE-2018-14486 · DNN Platform
DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.
Published 21 Mar 2019 · NVD - High 8.8
CVE-2019-9787 · WordPress
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is…
Published 14 Mar 2019 · Fixed in 5.1.1 · NVD - Medium 6.1
CVE-2019-6600 · F5 BIG-IP
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.
Published 13 Mar 2019 · NVD - Medium 6.1
CVE-2019-6599 · F5 BIG-IP
In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting (XSS) attack.
Published 13 Mar 2019 · NVD - Medium 4.3
CVE-2019-6598 · F5 BIG-IP
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, malformed requests to the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, may lead to disruption of TMUI services. This attack requires an authenticated user with any role (other than the No Access role). The No Access user…
Published 13 Mar 2019 · NVD - High 7.2
CVE-2019-6597 · F5 BIG-IP
In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
Published 13 Mar 2019 · NVD - High 7.5
CVE-2019-6596 · F5 BIG-IP
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messages in a DTLS session TMM may corrupt memory eventually leading to a crash. Only systems offering DTLS connections via APM are impacted.
Published 13 Mar 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.