Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,928
- Published in 7 days
- 1,033
- Critical in 30 days
- 362
- Actively exploited
- 423
Latest vulnerabilities
39,928 vulnerabilities- Medium 5.4
CVE-2018-14059 · Pimcore
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
Published 24 Aug 2018 · NVD - Medium 6.1
CVE-2018-15605 · phpMyAdmin
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
Published 24 Aug 2018 · Fixed in 4.8.3 · NVD - Medium 5.9
CVE-2018-1755 · IBM WebSphere Application Server
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC). This can happen when the Application Server is configured to permit access on non-secure (http) port and using JASPIC or JSR375 authentication.
Published 24 Aug 2018 · NVD - High 7.5
CVE-2018-15822 · FFmpeg
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.
Published 23 Aug 2018 · NVD - Medium 6.5
CVE-2018-1159 · MikroTik RouterOS
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.
Published 23 Aug 2018 · Fixed in 6.40.9, 6.42.7 · NVD - Medium 6.5
CVE-2018-1158 · MikroTik RouterOS
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
Published 23 Aug 2018 · Fixed in 6.40.9, 6.42.7 · NVD - Medium 6.5
CVE-2018-1157 · MikroTik RouterOS
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request.
Published 23 Aug 2018 · Fixed in 6.40.9, 6.42.7 · NVD - High 8.8
CVE-2018-1156 · MikroTik RouterOS
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.
Published 23 Aug 2018 · Fixed in 6.40.9, 6.42.7 · NVD - High 7.5
CVE-2003-1605 · curl
curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
Published 23 Aug 2018 · Fixed in 7.10.7 · NVD - Medium 6.5
CVE-2018-1999047 · Jenkins
A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center.
Published 23 Aug 2018 · NVD - Medium 4.3
CVE-2018-1999046 · Jenkins
A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.
Published 23 Aug 2018 · NVD - Medium 5.4
CVE-2018-1999045 · Jenkins
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
Published 23 Aug 2018 · NVD - Medium 6.5
CVE-2018-1999044 · Jenkins
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
Published 23 Aug 2018 · NVD - High 7.5
CVE-2018-1999043 · Jenkins
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.
Published 23 Aug 2018 · NVD - Medium 5.3
CVE-2018-1999042 · Jenkins
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
Published 23 Aug 2018 · NVD - Medium 6.5
CVE-2018-10919 · Samba
The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.
Published 22 Aug 2018 · Fixed in 4.6.16, 4.7.9, 4.8.4 · NVD - Medium 6.5
CVE-2018-10918 · Samba
A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.
Published 22 Aug 2018 · Fixed in 4.7.9, 4.8.4 · NVD - High 8.8
CVE-2018-10858 · Samba
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.
Published 22 Aug 2018 · Fixed in 4.6.16, 4.7.9, 4.8.4 · NVD - Medium 6.5
CVE-2018-1140 · Samba
A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable
Published 22 Aug 2018 · Fixed in 4.8.4 · NVD - High 8.1
CVE-2018-1139 · Samba
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
Published 22 Aug 2018 · Fixed in 4.7.9, 4.8.4 · NVD - High 8.1Actively exploited
CVE-2018-11776 · Apache Struts
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action…
Published 22 Aug 2018 · Fixed in 2.3.35, 2.5.17 · NVD - Medium 6.5
CVE-2018-15607 · ImageMagick
In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
Published 21 Aug 2018 · NVD - High 7.5
CVE-2018-7166 · Node.js
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be…
Published 21 Aug 2018 · Fixed in 10.9.0 · NVD - High 7.5
CVE-2018-12115 · Node.js
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to…
Published 21 Aug 2018 · Fixed in 6.14.4, 8.11.4, 10.9.0 · NVD - High 7.5
CVE-2018-15598 · Traefik
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
Published 21 Aug 2018 · Fixed in 1.6.6 · NVD - High 8.1
CVE-2016-7048 · PostgreSQL
The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.
Published 20 Aug 2018 · Fixed in 9.3.15, 9.4.10, 9.5.5 · NVD - High 7.8
CVE-2018-1000657 · Rust
Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in…
Published 20 Aug 2018 · Fixed in 1.22.0 · NVD - Critical 9.8
CVE-2018-1000641 · YesWiki
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code, disclosure of information.
Published 20 Aug 2018 · NVD - Medium 5.3
CVE-2018-15473 · OpenSSH
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Published 17 Aug 2018 · NVD - High 7.8
CVE-2018-15471 · Xen
An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed,…
Published 17 Aug 2018 · NVD - Medium 6.5
CVE-2018-15470 · Xen
An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not specified. In practice, different implementations behave differently. Thus, oxenstored may not enforce…
Published 17 Aug 2018 · NVD - Medium 6.5
CVE-2018-15469 · Xen
An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a…
Published 17 Aug 2018 · NVD - Medium 6.0
CVE-2018-15468 · Xen
An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case…
Published 17 Aug 2018 · NVD - Medium 6.5
CVE-2018-14058 · Pimcore
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
Published 17 Aug 2018 · Fixed in 5.3.0 · NVD - High 8.8
CVE-2018-14057 · Pimcore
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function.
Published 17 Aug 2018 · Fixed in 5.3.0 · NVD - High 7.8
CVE-2018-5546 · F5 BIG-IP
The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information, manipulate certain data, or assume super-user privileges on the local client…
Published 17 Aug 2018 · NVD - Medium 6.5
CVE-2018-14567 · libxml2
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
Published 16 Aug 2018 · NVD - Medium 6.5
CVE-2016-9598 · libxml2
libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.
Published 16 Aug 2018 · Fixed in 2.9.4 · NVD - Medium 6.5
CVE-2016-9596 · libxml2
libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.
Published 16 Aug 2018 · Fixed in 2.9.4 · NVD - Medium 4.3
CVE-2018-10140 · Palo Alto Networks PAN-OS
The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.
Published 16 Aug 2018 · NVD - Medium 6.1
CVE-2018-10139 · Palo Alto Networks PAN-OS
The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.
Published 16 Aug 2018 · NVD - Medium 5.5
CVE-2018-11771 · Oracle WebLogic Server
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip…
Published 16 Aug 2018 · NVD - Medium 4.3
CVE-2018-8374 · Microsoft Exchange Server
A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects Microsoft Exchange Server.
Published 15 Aug 2018 · NVD - Critical 9.8
CVE-2018-8302 · Microsoft Exchange Server
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.
Published 15 Aug 2018 · NVD - Medium 6.1
CVE-2016-4975 · Apache HTTP Server
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
Published 14 Aug 2018 · NVD - Medium 5.4
CVE-2018-3780 · Nextcloud
A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.
Published 13 Aug 2018 · Fixed in 13.0.5 · NVD - Medium 5.3
CVE-2018-3776 · Nextcloud
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.
Published 12 Aug 2018 · Fixed in 11.0.5, 12.0.3 · NVD - High 8.8
CVE-2018-3775 · Nextcloud
Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.
Published 12 Aug 2018 · Fixed in 12.0.3 · NVD - High 7.2
CVE-2018-14028 · WordPress
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does…
Published 10 Aug 2018 · NVD - High 8.1
CVE-2018-10925 · PostgreSQL
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular…
Published 9 Aug 2018 · Fixed in 9.5.14, 9.6.10, 10.5 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.