Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,928
- Published in 7 days
- 1,033
- Critical in 30 days
- 362
- Actively exploited
- 423
Latest vulnerabilities
39,928 vulnerabilities- Critical 9.8Actively exploited
CVE-2018-15961 · Adobe ColdFusion
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
Published 25 Sept 2018 · NVD - High 7.5
CVE-2018-15960 · Adobe ColdFusion
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to arbitrary file overwrite.
Published 25 Sept 2018 · NVD - Critical 9.8
CVE-2018-15959 · Adobe ColdFusion
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Published 25 Sept 2018 · NVD - Critical 9.8
CVE-2018-15958 · Adobe ColdFusion
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Published 25 Sept 2018 · NVD - Critical 9.8
CVE-2018-15957 · Adobe ColdFusion
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Published 25 Sept 2018 · NVD - High 7.5
CVE-2018-14647 · Python
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6,…
Published 25 Sept 2018 · NVD - Medium 6.1
CVE-2018-17003 · LimeSurvey
In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert.
Published 21 Sept 2018 · NVD - High 8.6
CVE-2018-16793 · Microsoft Exchange Server
Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.
Published 21 Sept 2018 · NVD - High 7.5
CVE-2018-14645 · HAProxy
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.
Published 21 Sept 2018 · NVD - High 8.8
CVE-2018-3831 · Elasticsearch
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
Published 19 Sept 2018 · Fixed in 5.6.12, 6.4.1 · NVD - Medium 6.1
CVE-2018-3830 · Kibana
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Published 19 Sept 2018 · NVD - Medium 6.5
CVE-2018-3826 · Elasticsearch
In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.
Published 19 Sept 2018 · NVD - High 7.8
CVE-2018-17183 · Ghostscript
Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.
Published 19 Sept 2018 · Fixed in 9.25 · NVD - Unrated
WPV-01e34f670867 · WP Mail Smtp (WordPress plugin)
Vulnerability in WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP
Published 19 Sept 2018 · Fixed in 1.4.0 · WPVulnerability - High 7.5
CVE-2018-13982 · Smarty
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
Published 18 Sept 2018 · Fixed in 3.1.33 · NVD - Critical 9.8
CVE-2018-1000802 · Python
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered…
Published 18 Sept 2018 · Fixed in 2.7.16 · NVD - Unrated
WPV-f204757c4c2b · WPForms Lite
Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Published 18 Sept 2018 · Fixed in 1.4.8 · WPVulnerability - Medium 6.1
CVE-2018-14631 · Moodle
moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.
Published 17 Sept 2018 · Fixed in 3.3.8, 3.4.5, 3.5.2 · NVD - High 8.8
CVE-2018-14630 · Moodle
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
Published 17 Sept 2018 · Fixed in 3.3.8, 3.4.5, 3.5.2 · NVD - Medium 5.4
CVE-2018-17128 · MyBB
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
Published 17 Sept 2018 · Fixed in 1.8.19 · NVD - Medium 6.1
CVE-2018-17082 · PHP
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Published 16 Sept 2018 · Fixed in 7.0.32, 7.1.22, 7.2.10 · NVD - Critical 9.8
CVE-2018-17057 · LimeSurvey
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Published 14 Sept 2018 · Fixed in 3.16.0 · NVD - Medium 5.9
CVE-2018-1719 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions. This could result in a downgrade of TLS protocol. A remote attacker could exploit this vulnerability to perform man-in-the-middle attacks. IBM X-Force ID: 147292.
Published 14 Sept 2018 · NVD - Medium 6.1
CVE-2018-17031 · Gogs
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.
Published 14 Sept 2018 · NVD - High 7.5
CVE-2018-5549 · F5 BIG-IP
On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements.
Published 13 Sept 2018 · NVD - Medium 6.1
CVE-2018-5548 · F5 BIG-IP
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.
Published 13 Sept 2018 · NVD - Medium 4.3
CVE-2018-15310 · F5 BIG-IP
A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages.
Published 13 Sept 2018 · NVD - High 7.5
CVE-2018-8409 · .NET
A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.
Published 13 Sept 2018 · Fixed in 2.1.4 · NVD - Unrated
WPV-46ad0a1e402e · Contact Form 7
Vulnerability in Contact Form 7
Published 13 Sept 2018 · Fixed in 5.0.4 · WPVulnerability - Medium 5.9
CVE-2018-16831 · Smarty
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement.
Published 11 Sept 2018 · NVD - High 7.4
CVE-2018-11775 · Apache ActiveMQ
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
Published 10 Sept 2018 · Fixed in 5.15.6 · NVD - High 7.5
CVE-2018-12608 · Docker Engine
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.
Published 10 Sept 2018 · Fixed in 17.06.0 · NVD - High 7.8
CVE-2018-16802 · Ghostscript
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
Published 10 Sept 2018 · Fixed in 9.25 · NVD - Medium 5.5
CVE-2016-7056 · OpenSSL
A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.
Published 10 Sept 2018 · NVD - Medium 6.5
CVE-2018-16750 · ImageMagick
In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.
Published 9 Sept 2018 · Fixed in 6.9.9-42 · NVD - Medium 6.5
CVE-2018-16749 · ImageMagick
In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.
Published 9 Sept 2018 · Fixed in 6.9.9-42 · NVD - Critical 9.8
CVE-2018-1567 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized object from untrusted sources. IBM X-Force ID: 143024.
Published 7 Sept 2018 · NVD - Critical 9.8
CVE-2018-6320 · Ivanti Connect Secure
A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an http(s) Host header received from the browser is trusted without validation.
Published 6 Sept 2018 · NVD - Medium 6.1
CVE-2018-14366 · Ivanti Connect Secure
download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability.
Published 6 Sept 2018 · NVD - Medium 6.5
CVE-2018-16645 · ImageMagick
There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file.
Published 6 Sept 2018 · NVD - Medium 6.5
CVE-2018-16644 · ImageMagick
There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.
Published 6 Sept 2018 · NVD - Medium 6.5
CVE-2018-16643 · ImageMagick
The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file.
Published 6 Sept 2018 · NVD - Medium 6.5
CVE-2018-16642 · ImageMagick
The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.
Published 6 Sept 2018 · NVD - Medium 6.5
CVE-2018-16641 · ImageMagick
ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c.
Published 6 Sept 2018 · NVD - Medium 6.5
CVE-2018-16640 · ImageMagick
ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.
Published 6 Sept 2018 · NVD - High 7.5
CVE-2018-5391 · F5 BIG-IP
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became…
Published 6 Sept 2018 · Fixed in 13.1.3, 14.0.1.1, 14.1.2.4 · NVD - Medium 6.1
CVE-2018-5005 · Adobe Experience Manager
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
Published 6 Sept 2018 · NVD - High 8.8
CVE-2018-1000659 · LimeSurvey
LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in remote code execution as authenticated user. This attack appear to be exploitable via An authenticated user can upload a specially crafted zip file to get remote code execution. This vulnerability appears to have been…
Published 6 Sept 2018 · NVD - High 8.8
CVE-2018-1000658 · LimeSurvey
LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after…
Published 6 Sept 2018 · Fixed in 3.14.4 · NVD - High 8.8
CVE-2018-1000773 · WordPress
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time.
Published 6 Sept 2018 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.