Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,921
- Published in 7 days
- 1,021
- Critical in 30 days
- 358
- Actively exploited
- 423
Latest vulnerabilities
39,921 vulnerabilities- High 7.5
CVE-2018-20783 · PHP
In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
Published 21 Feb 2019 · Fixed in 7.0.33, 7.1.25, 7.2.13 · NVD - Medium 5.4
CVE-2019-5727 · Splunk Enterprise
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.
Published 21 Feb 2019 · Fixed in 6.4.9, 6.5.5, 6.6.0 · NVD - High 7.5
CVE-2019-3924 · MikroTik RouterOS
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for general network scanning activities.
Published 20 Feb 2019 · Fixed in 6.42.12, 6.43.12 · NVD - Medium 6.1
CVE-2019-8331 · F5 BIG-IP
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Published 20 Feb 2019 · Fixed in 13.1.3.4, 14.1.2.5, 15.1.0 · NVD - Medium 6.5
CVE-2019-8943 · WordPress
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
Published 20 Feb 2019 · NVD - High 8.8
CVE-2019-8942 · WordPress
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
Published 20 Feb 2019 · Fixed in 4.9.9 · NVD - Medium 6.1
CVE-2019-9168 · WooCommerce
WooCommerce: Cross-site Scripting
Published 20 Feb 2019 · Fixed in 3.5.5 · NVD, WPVulnerability - Medium 5.5
CVE-2018-9867 · SonicWall SonicOS
In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv…
Published 19 Feb 2019 · NVD - Medium 5.3
CVE-2018-1996 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650.
Published 19 Feb 2019 · NVD - Medium 6.1
CVE-2016-10742 · Zabbix
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.
Published 17 Feb 2019 · NVD - High 8.1
CVE-2019-6974 · F5 BIG-IP
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
Published 15 Feb 2019 · Fixed in 15.1.0 · NVD - Unrated
WPV-51212ef94733 · Advanced Custom Fields
Vulnerability in Advanced Custom Fields (ACF®)
Published 15 Feb 2019 · Fixed in 5.7.12 · WPVulnerability - Medium 6.1
CVE-2019-6589 · F5 BIG-IP
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.
Published 14 Feb 2019 · NVD - Unrated
WPV-356a4def238d · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 14 Feb 2019 · Fixed in 7.0.1 · WPVulnerability - Medium 6.5
CVE-2018-20237 · Confluence
Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature.
Published 13 Feb 2019 · Fixed in 6.13.1, 6.14.0 · NVD - Medium 5.4
CVE-2018-20232 · Jira
The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.
Published 13 Feb 2019 · Fixed in 7.6.11, 7.13.1 · NVD - Medium 4.1
CVE-2018-13404 · Jira
The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote…
Published 13 Feb 2019 · Fixed in 7.11.3, 7.12.3, 7.13.1 · NVD - Medium 5.4
CVE-2018-13403 · Jira
The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard.
Published 13 Feb 2019 · Fixed in 7.6.10, 7.13.1 · NVD - Medium 6.1
CVE-2019-7744 · Joomla!
An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.
Published 12 Feb 2019 · NVD - Critical 9.8
CVE-2019-7743 · Joomla!
An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
Published 12 Feb 2019 · NVD - Medium 6.1
CVE-2019-7742 · Joomla!
An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector.
Published 12 Feb 2019 · NVD - Medium 6.1
CVE-2019-7741 · Joomla!
An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS.
Published 12 Feb 2019 · NVD - Medium 6.1
CVE-2019-7740 · Joomla!
An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector.
Published 12 Feb 2019 · NVD - Medium 6.1
CVE-2019-7739 · Joomla!
An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior. However, it might be unexpected for the user because the configuration dialog lacks an additional message to explain this.
Published 12 Feb 2019 · NVD - High 8.6
CVE-2019-5736 · Docker Engine, runc
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write…
Published 11 Feb 2019 · Fixed in 18.09.2 · NVD - Critical 9.8
CVE-2018-1352 · Fortinet FortiOS
A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable.
Published 8 Feb 2019 · NVD - High 7.5
CVE-2019-3823 · curl
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
Published 6 Feb 2019 · Fixed in 7.64.0 · NVD - Critical 9.8
CVE-2019-3822 · curl, MySQL
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned…
Published 6 Feb 2019 · Fixed in 7.64.0 · NVD - High 7.5
CVE-2018-16890 · F5 BIG-IP, curl
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset…
Published 6 Feb 2019 · Fixed in 7.64.0 · NVD - Medium 5.9
CVE-2019-6590 · F5 BIG-IP
On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic.
Published 5 Feb 2019 · NVD - Medium 5.4
CVE-2019-6591 · F5 BIG-IP
On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.
Published 5 Feb 2019 · NVD - High 7.5
CVE-2019-7398 · ImageMagick
In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.
Published 5 Feb 2019 · Fixed in 6.9.10-25, 7.0.8-25 · NVD - High 7.5
CVE-2019-7397 · ImageMagick
In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.
Published 5 Feb 2019 · Fixed in 6.9.10-25, 7.0.8-25 · NVD - High 7.5
CVE-2019-7396 · ImageMagick
In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.
Published 5 Feb 2019 · Fixed in 6.9.10-25, 7.0.8-25 · NVD - High 7.5
CVE-2019-7395 · ImageMagick
In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.
Published 5 Feb 2019 · Fixed in 6.9.10-25, 7.0.8-25 · NVD - Medium 6.5
CVE-2019-1000017 · Chamilo LMS
Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit…
Published 4 Feb 2019 · NVD - Medium 6.5
CVE-2019-1000016 · FFmpeg
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.
Published 4 Feb 2019 · NVD - Medium 6.1
CVE-2019-1000015 · Chamilo LMS
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack…
Published 4 Feb 2019 · NVD - Medium 6.5
CVE-2019-1000002 · Gitea
Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3,…
Published 4 Feb 2019 · NVD - Medium 5.3
CVE-2019-7317 · Java, MySQL
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Published 4 Feb 2019 · Fixed in 8.0.23 · NVD - Medium 5.5
CVE-2019-7309 · GNU C Library
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
Published 3 Feb 2019 · NVD - Medium 5.9
CVE-2019-6111 · OpenSSH
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp…
Published 31 Jan 2019 · NVD - Medium 6.8
CVE-2019-6110 · OpenSSH
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
Published 31 Jan 2019 · NVD - Medium 6.8
CVE-2019-6109 · OpenSSH
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
Published 31 Jan 2019 · NVD - High 7.5
CVE-2019-0190 · Apache HTTP Server
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.
Published 30 Jan 2019 · NVD - High 7.5
CVE-2018-17199 · Apache HTTP Server
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.
Published 30 Jan 2019 · NVD - Medium 5.3
CVE-2018-17189 · Apache HTTP Server
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
Published 30 Jan 2019 · NVD - Medium 6.1
CVE-2019-1566 · Palo Alto Networks PAN-OS
The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.
Published 30 Jan 2019 · Fixed in 7.1.22, 8.0.15, 8.1.6 · NVD - Medium 5.4
CVE-2019-1565 · Palo Alto Networks PAN-OS
The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML.
Published 30 Jan 2019 · NVD - Medium 6.1
CVE-2018-19727 · Adobe Experience Manager
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
Published 28 Jan 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.