Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,921
- Published in 7 days
- 1,021
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,921 vulnerabilities- High 7.2
CVE-2019-6597 · F5 BIG-IP
In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
Published 13 Mar 2019 · NVD - High 7.5
CVE-2019-6596 · F5 BIG-IP
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messages in a DTLS session TMM may corrupt memory eventually leading to a crash. Only systems offering DTLS connections via APM are impacted.
Published 13 Mar 2019 · NVD - Medium 6.1
CVE-2019-9740 · Python
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18,…
Published 13 Mar 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD - Medium 6.1
CVE-2019-9714 · Joomla!
An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS.
Published 12 Mar 2019 · Fixed in 3.9.4 · NVD - High 7.5
CVE-2019-9713 · Joomla!
An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access.
Published 12 Mar 2019 · Fixed in 3.9.4 · NVD - Medium 6.1
CVE-2019-9712 · Joomla!
An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS.
Published 12 Mar 2019 · Fixed in 3.9.4 · NVD - Medium 6.1
CVE-2019-9711 · Joomla!
An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS.
Published 12 Mar 2019 · Fixed in 3.9.4 · NVD - Medium 6.5
CVE-2019-9721 · FFmpeg
A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
Published 12 Mar 2019 · NVD - Medium 6.5
CVE-2019-9718 · FFmpeg
In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.
Published 12 Mar 2019 · NVD - Medium 4.3
CVE-2018-1902 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. IBM X-Force ID: 152531.
Published 11 Mar 2019 · Fixed in 19.0.0.3 · NVD - High 8.1
CVE-2019-9675 · PHP
An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.
Published 11 Mar 2019 · Fixed in 7.1.27, 7.3.3 · NVD - Critical 9.8
CVE-2019-9641 · PHP
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.
Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD - High 7.5
CVE-2019-9640 · PHP
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.
Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD - High 7.5
CVE-2019-9639 · PHP
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.
Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD - High 7.5
CVE-2019-9638 · PHP
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.
Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD - High 7.5
CVE-2019-9637 · PHP
An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.
Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD - Critical 9.8
CVE-2019-9636 · Python
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be…
Published 8 Mar 2019 · Fixed in 3.5.7, 3.6.9, 3.7.3 · NVD - High 7.5
CVE-2017-3164 · Apache Solr
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
Published 8 Mar 2019 · NVD - High 7.5
CVE-2019-7175 · ImageMagick
In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
Published 7 Mar 2019 · Fixed in 6.9.10-25, 7.0.8-25 · NVD - Critical 9.8
CVE-2018-16809 · Dolibarr ERP CRM
An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.
Published 7 Mar 2019 · NVD - Medium 6.1
CVE-2018-16808 · Dolibarr ERP CRM
An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note.
Published 7 Mar 2019 · NVD - Critical 9.8
CVE-2019-0192 · Apache Solr
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
Published 7 Mar 2019 · NVD - High 7.5
CVE-2018-11783 · Apache Traffic Server
sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.
Published 7 Mar 2019 · NVD - High 8.8
CVE-2019-9625 · DirectAdmin
JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account.
Published 7 Mar 2019 · NVD - High 7.8
CVE-2019-9624 · Webmin
Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.
Published 7 Mar 2019 · NVD - High 7.4
CVE-2019-1543 · OpenSSL
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are…
Published 6 Mar 2019 · NVD - Medium 5.4
CVE-2019-4030 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155946.
Published 6 Mar 2019 · NVD - Medium 6.5
CVE-2019-3824 · Samba
A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service.
Published 6 Mar 2019 · Fixed in 4.10.0 · NVD - High 8.1
CVE-2019-0724 · Microsoft Exchange Server
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0686.
Published 5 Mar 2019 · NVD - High 7.4
CVE-2019-0686 · Microsoft Exchange Server
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.
Published 5 Mar 2019 · NVD - High 7.5
CVE-2018-20799 · pfSense
In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication (the behavior does not match the sshguard documentation), which might make it easier for attackers to bypass intended access restrictions.
Published 1 Mar 2019 · NVD - High 7.5
CVE-2018-20798 · pfSense
The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by sshguard, which might make it easier for attackers to bypass intended access restrictions.
Published 1 Mar 2019 · NVD - Medium 5.9
CVE-2019-1559 · F5 BIG-IP, Node.js, OpenSSL and 2 more
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is…
Published 27 Feb 2019 · Fixed in 8.1.8, 8.15.1, 9.0.2 · NVD - Medium 5.5
CVE-2018-20244 · Apache Airflow
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Published 27 Feb 2019 · Fixed in 1.10.2 · NVD - High 7.5
CVE-2019-9192 · GNU C Library
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
Published 26 Feb 2019 · NVD - Medium 6.1
CVE-2019-6595 · F5 BIG-IP
Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.
Published 26 Feb 2019 · NVD - Medium 5.9
CVE-2019-6594 · F5 BIG-IP
On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances.
Published 26 Feb 2019 · NVD - Medium 5.9
CVE-2019-6593 · F5 BIG-IP
On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as…
Published 26 Feb 2019 · NVD - Critical 9.1
CVE-2019-6592 · F5 BIG-IP
On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.
Published 26 Feb 2019 · NVD - Critical 9.8
CVE-2019-9169 · GNU C Library
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
Published 26 Feb 2019 · NVD - High 7.5
CVE-2018-20796 · GNU C Library
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Published 26 Feb 2019 · NVD - High 7.5
CVE-2009-5155 · GNU C Library
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.
Published 26 Feb 2019 · Fixed in 2.28 · NVD - High 7.8
CVE-2019-9075 · F5 BIG-IP
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.
Published 24 Feb 2019 · NVD - Critical 9.8
CVE-2019-9025 · PHP
An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data.
Published 22 Feb 2019 · Fixed in 7.3.1 · NVD - High 7.5
CVE-2019-9024 · PHP
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.
Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD - Critical 9.8
CVE-2019-9023 · PHP
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c,…
Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD - High 7.5
CVE-2019-9022 · PHP
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.
Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.2 · NVD - Critical 9.8
CVE-2019-9021 · PHP
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to…
Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD - Critical 9.8
CVE-2019-9020 · PHP
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.
Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD - High 8.1Actively exploited
CVE-2019-6340 · Drupal
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has…
Published 21 Feb 2019 · Fixed in 8.5.11, 8.6.10 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.