UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,921
Published in 7 days
1,026
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,921 vulnerabilities
  1. Critical 9.8

    CVE-2018-15708 · Nagios XI

    Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.

    Published 14 Nov 2018 · NVD
  2. High 7.4Actively exploited

    CVE-2018-8581 · Microsoft Exchange Server

    An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

    Published 14 Nov 2018 · NVD
  3. Medium 6.5

    CVE-2018-8416 · .NET

    A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

    Published 14 Nov 2018 · NVD
  4. Unrated

    WPV-5af05bf9a2a3 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 14 Nov 2018 · Fixed in 3.6.4 · WPVulnerability
  5. Critical 9.8

    CVE-2018-16850 · PostgreSQL

    postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

    Published 13 Nov 2018 · Fixed in 10.6, 11.1 · NVD
  6. Medium 6.1

    CVE-2018-19206 · Roundcube

    steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

    Published 12 Nov 2018 · Fixed in 1.3.8 · NVD
  7. High 7.5

    CVE-2018-19205 · Roundcube

    Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.

    Published 12 Nov 2018 · Fixed in 1.3.7 · NVD
  8. Medium 6.1

    CVE-2018-1798 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149428.

    Published 12 Nov 2018 · NVD
  9. Low 3.7

    CVE-2018-19148 · Caddy

    Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Host header) permit full enumeration of…

    Published 10 Nov 2018 · NVD
  10. Medium 5.9

    CVE-2018-19132 · Squid

    Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

    Published 9 Nov 2018 · Fixed in 4.4 · NVD
  11. Medium 6.1

    CVE-2018-19131 · Squid

    Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

    Published 9 Nov 2018 · Fixed in 4.4 · NVD
  12. Critical 9.8

    CVE-2018-19126 · PrestaShop

    PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.

    Published 9 Nov 2018 · Fixed in 1.6.1.23, 1.7.4.4 · NVD
  13. High 7.5

    CVE-2018-19125 · PrestaShop

    PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.

    Published 9 Nov 2018 · Fixed in 1.6.1.23, 1.7.4.4 · NVD
  14. High 7.5

    CVE-2018-19124 · PrestaShop

    PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files.

    Published 9 Nov 2018 · Fixed in 1.6.1.23, 1.7.4.4 · NVD
  15. Critical 9.8

    CVE-2018-8021 · Apache Superset

    Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

    Published 7 Nov 2018 · Fixed in 0.23 · NVD
  16. Medium 6.1

    CVE-2018-16845 · nginx

    nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the…

    Published 7 Nov 2018 · NVD
  17. High 7.5

    CVE-2018-16844 · nginx

    nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

    Published 7 Nov 2018 · Fixed in 1.14.1, 1.15.6 · NVD
  18. High 7.5

    CVE-2018-16843 · nginx

    nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

    Published 7 Nov 2018 · Fixed in 1.14.1, 1.15.6 · NVD
  19. High 7.5

    CVE-2018-19052 · lighttpd

    An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.

    Published 7 Nov 2018 · Fixed in 1.4.50 · NVD
  20. Unrated

    WPV-1e428416175d · WooCommerce

    Vulnerability in WooCommerce

    Published 7 Nov 2018 · Fixed in 3.4.6 · WPVulnerability
  21. High 8.1

    CVE-2018-20714 · WooCommerce

    WooCommerce: Path Traversal

    Published 6 Nov 2018 · Fixed in 3.4.6 · NVD, WPVulnerability
  22. Medium 6.6

    CVE-2018-19370 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Race Condition

    Published 6 Nov 2018 · Fixed in 9.2.0 · NVD, WPVulnerability
  23. Critical 9.8

    CVE-2018-18926 · Gitea

    Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

    Published 4 Nov 2018 · Fixed in 1.5.4 · NVD
  24. Critical 9.8

    CVE-2018-18925 · Gogs

    Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

    Published 4 Nov 2018 · NVD
  25. High 8.8

    CVE-2016-2123 · Samba

    A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write…

    Published 1 Nov 2018 · Fixed in 4.3.13, 4.4.8, 4.5.3 · NVD
  26. High 8.6

    CVE-2018-15454 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An…

    Published 1 Nov 2018 · Fixed in 9.8.3.16, 9.9.2.32, 9.10.1.2 · NVD
  27. High 8.8

    CVE-2018-18883 · Xen

    An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted.

    Published 1 Nov 2018 · NVD
  28. Medium 6.5

    CVE-2016-2125 · Samba

    It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

    Published 31 Oct 2018 · Fixed in 4.3.13, 4.4.8, 4.5.3 · NVD
  29. Critical 9.1

    CVE-2018-16842 · curl

    Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

    Published 31 Oct 2018 · NVD
  30. Critical 9.8

    CVE-2018-16840 · curl

    A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

    Published 31 Oct 2018 · Fixed in 7.62.0 · NVD
  31. Critical 9.8

    CVE-2018-16839 · curl

    Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

    Published 31 Oct 2018 · NVD
  32. High 7.2

    CVE-2018-15327 · F5 BIG-IP

    In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

    Published 31 Oct 2018 · NVD
  33. High 7.5

    CVE-2018-15326 · F5 BIG-IP

    In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List.

    Published 31 Oct 2018 · NVD
  34. Medium 4.3

    CVE-2018-15325 · F5 BIG-IP

    In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executing commands

    Published 31 Oct 2018 · NVD
  35. Medium 5.9

    CVE-2018-15324 · F5 BIG-IP

    On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access.

    Published 31 Oct 2018 · NVD
  36. Medium 5.9

    CVE-2018-15323 · F5 BIG-IP

    On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action.

    Published 31 Oct 2018 · NVD
  37. Medium 6.5

    CVE-2018-15322 · F5 BIG-IP

    On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.0.1-2.3.0, or Enterprise Manager 3.1.1 a BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service (DoS) when the BIG-IP user uses the tmsh utility…

    Published 31 Oct 2018 · NVD
  38. Medium 4.9

    CVE-2018-15321 · F5 BIG-IP

    When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.1.0-2.3.0, or Enterprise Manager 3.1.1 is licensed for Appliance Mode, Admin and Resource administrator roles can by-pass BIG-IP Appliance Mode restrictions to overwrite critical system files.…

    Published 31 Oct 2018 · NVD
  39. High 7.5

    CVE-2018-15320 · F5 BIG-IP

    On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than "allow-all".

    Published 31 Oct 2018 · NVD
  40. High 7.5

    CVE-2018-15319 · F5 BIG-IP

    On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies.

    Published 31 Oct 2018 · NVD
  41. High 7.5

    CVE-2018-15318 · F5 BIG-IP

    In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this condition.

    Published 31 Oct 2018 · NVD
  42. High 7.5

    CVE-2018-15317 · F5 BIG-IP

    In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSL Virtual Server will cause corruption in the SSL data structures leading to intermittent decrypt BAD_RECORD_MAC errors. Clients will be unable to access the application load balanced by a virtual server with an SSL profile until tmm is restarted.

    Published 31 Oct 2018 · NVD
  43. Critical 9.8

    CVE-2018-1851 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999.

    Published 31 Oct 2018 · Fixed in 18.0.0.3 · NVD
  44. Medium 5.3

    CVE-2018-16467 · Nextcloud

    A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.

    Published 30 Oct 2018 · Fixed in 14.0.0 · NVD
  45. High 8.1

    CVE-2018-16466 · Nextcloud

    Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.

    Published 30 Oct 2018 · Fixed in 12.0.11, 13.0.6 · NVD
  46. Medium 5.3

    CVE-2018-16465 · Nextcloud

    Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.

    Published 30 Oct 2018 · Fixed in 14.0.0 · NVD
  47. Medium 5.7

    CVE-2018-16464 · Nextcloud

    A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.

    Published 30 Oct 2018 · Fixed in 14.0.0 · NVD
  48. Low 3.1

    CVE-2018-16463 · Nextcloud

    A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.

    Published 30 Oct 2018 · Fixed in 12.0.8, 13.0.3 · NVD
  49. Medium 5.9

    CVE-2018-0734 · Node.js, OpenSSL

    The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

    Published 30 Oct 2018 · Fixed in 6.15.0, 8.14.0, 11.3.0 · NVD
  50. Medium 6.1

    CVE-2018-1767 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148621.

    Published 29 Oct 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.