UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,915
Published in 7 days
1,020
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,915 vulnerabilities
  1. High 8.2

    CVE-2018-1000863 · Jenkins

    A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

    Published 10 Dec 2018 · NVD
  2. Medium 4.3

    CVE-2018-1000862 · Jenkins

    An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.

    Published 10 Dec 2018 · NVD
  3. Critical 9.8Actively exploited

    CVE-2018-1000861 · Jenkins

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

    Published 10 Dec 2018 · NVD
  4. Unrated

    WPV-9841f281bc2b · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 10 Dec 2018 · Fixed in 1.4.8.1 · WPVulnerability
  5. Unrated

    WPV-91eef9642814 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 10 Dec 2018 · Fixed in 5.7.8 · WPVulnerability
  6. Unrated

    WPV-5915ef436117 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 10 Dec 2018 · Fixed in 1.4.8.1 · WPVulnerability
  7. Medium 6.5

    CVE-2018-19967 · Xen

    An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix.

    Published 8 Dec 2018 · NVD
  8. High 8.8

    CVE-2018-19966 · Xen

    An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.

    Published 8 Dec 2018 · NVD
  9. Medium 5.6

    CVE-2018-19965 · Xen

    An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.

    Published 8 Dec 2018 · NVD
  10. Medium 6.5

    CVE-2018-19964 · Xen

    An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions.

    Published 8 Dec 2018 · NVD
  11. High 7.8

    CVE-2018-19963 · Xen

    An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.

    Published 8 Dec 2018 · NVD
  12. High 7.8

    CVE-2018-19962 · Xen

    An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.

    Published 8 Dec 2018 · NVD
  13. High 7.8

    CVE-2018-19961 · Xen

    An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.

    Published 8 Dec 2018 · NVD
  14. High 7.5

    CVE-2018-7080 · HPE ArubaOS

    A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit the vulnerability could install new, potentially malicious firmware into the AP's BLE radio and could then gain access to the AP's console port. This vulnerability is applicable only if the BLE radio has been enabled in affected access points. The BLE radio…

    Published 7 Dec 2018 · Fixed in 6.5.4.9, 8.2.2.2, 8.3.0.4 · NVD
  15. High 7.5

    CVE-2018-19935 · PHP

    ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.

    Published 7 Dec 2018 · Fixed in 7.0.33, 7.1.26, 7.2.14 · NVD
  16. Unrated

    WPV-e93844f8f8ff · WP Mail Smtp (WordPress plugin)

    Vulnerability in WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP

    Published 7 Dec 2018 · Fixed in 1.4.0 · WPVulnerability
  17. Unrated

    WPV-d363ba651db3 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 7 Dec 2018 · Fixed in 1.4.8 · WPVulnerability
  18. Medium 5.4

    CVE-2018-20986 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Cross-site Scripting

    Published 7 Dec 2018 · Fixed in 5.7.8 · NVD, WPVulnerability
  19. High 7.0

    CVE-2018-15332 · F5 BIG-IP

    The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host in a race condition.

    Published 6 Dec 2018 · NVD
  20. Unrated

    WPV-c76079ebced5 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 6 Dec 2018 · Fixed in 3.6.4 · WPVulnerability
  21. Critical 9.8

    CVE-2018-1002105 · Kubernetes

    In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's…

    Published 5 Dec 2018 · NVD
  22. Critical 9.8

    CVE-2018-1002101 · Kubernetes

    In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.

    Published 5 Dec 2018 · NVD
  23. High 8.1

    CVE-2018-19786 · HashiCorp Vault

    HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.

    Published 5 Dec 2018 · Fixed in 1.0.0 · NVD
  24. Critical 10.0

    CVE-2018-18843 · GitLab

    The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF.

    Published 4 Dec 2018 · Fixed in 11.2.8, 11.3.9, 11.4.4 · NVD
  25. High 7.5

    CVE-2018-18648 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through an Error Message.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  26. Medium 6.5

    CVE-2018-18647 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  27. High 8.8

    CVE-2018-18646 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  28. Medium 4.3

    CVE-2018-18645 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exposure via unsubscribe links in email replies.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  29. Medium 6.5

    CVE-2018-18644 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows Information Exposure via a Gitlab Prometheus integration.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  30. Medium 6.1

    CVE-2018-18642 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  31. Critical 9.8

    CVE-2018-18641 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of Sensitive Information.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  32. Medium 6.5

    CVE-2018-18640 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through Browser Caching.

    Published 4 Dec 2018 · Fixed in 11.2.7, 11.3.8, 11.4.3 · NVD
  33. Medium 6.5

    CVE-2018-17976 · GitLab

    An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions.

    Published 4 Dec 2018 · Fixed in 11.1.8, 11.2.5, 11.3.2 · NVD
  34. Medium 5.3

    CVE-2018-17975 · GitLab

    An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API.

    Published 4 Dec 2018 · Fixed in 11.1.8, 11.2.5, 11.3.2 · NVD
  35. High 7.5

    CVE-2018-17939 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the merge request JSON endpoint.

    Published 4 Dec 2018 · Fixed in 11.1.8, 11.2.5, 11.3.2 · NVD
  36. High 7.5

    CVE-2018-19591 · GNU C Library

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

    Published 4 Dec 2018 · NVD
  37. Medium 5.4

    CVE-2018-16628 · Kirby

    panel/login in Kirby v2.5.12 allows XSS via a blog name.

    Published 4 Dec 2018 · NVD
  38. Medium 6.5

    CVE-2018-6982 · VMware ESXi

    VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may lead to an information leak from host to guest.

    Published 4 Dec 2018 · NVD
  39. High 8.8

    CVE-2018-6981 · VMware ESXi

    VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG, VMware Workstation 15, VMware Workstation 14.1.3 or below, VMware Fusion 11, VMware Fusion 10.1.3 or below contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may allow a guest to execute code on the host.

    Published 4 Dec 2018 · NVD
  40. High 7.2

    CVE-2018-4021 · pfSense

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the…

    Published 3 Dec 2018 · NVD
  41. High 7.2

    CVE-2018-4020 · pfSense

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the…

    Published 3 Dec 2018 · NVD
  42. High 7.2

    CVE-2018-4019 · pfSense

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the…

    Published 3 Dec 2018 · NVD
  43. High 7.8

    CVE-2018-16863 · Ghostscript

    It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.

    Published 3 Dec 2018 · NVD
  44. High 8.1

    CVE-2018-1840 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federated repository other than global federated repository and then migrated to a newer release of WebSphere Application Server. IBM X-Force ID: 150813.

    Published 3 Dec 2018 · NVD
  45. Medium 6.7

    CVE-2018-19792 · OpenLiteSpeed

    The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function.

    Published 3 Dec 2018 · NVD
  46. Medium 6.5

    CVE-2018-19791 · OpenLiteSpeed

    The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.

    Published 3 Dec 2018 · Fixed in 1.5.0 · NVD
  47. Critical 9.8

    CVE-2018-18649 · GitLab

    An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for remote code execution.

    Published 29 Nov 2018 · Fixed in 11.3.8, 11.4.3 · NVD
  48. Unrated

    WPV-c3dc76e07403 · WooCommerce

    Vulnerability in WooCommerce

    Published 29 Nov 2018 · Fixed in 3.5.2 · WPVulnerability
  49. Medium 4.3

    CVE-2018-12123 · Node.js

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the…

    Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD
  50. High 7.5

    CVE-2018-12122 · Node.js

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

    Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.