UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,928
Published in 7 days
1,033
Critical in 30 days
362
Actively exploited
423

Latest vulnerabilities

39,928 vulnerabilities
  1. High 7.5

    CVE-2018-10915 · PostgreSQL

    A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause…

    Published 9 Aug 2018 · Fixed in 9.5.14, 9.6.10, 10.5 · NVD
  2. High 7.2

    CVE-2018-11769 · Apache CouchDB

    CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not…

    Published 8 Aug 2018 · Fixed in 2.2.0 · NVD
  3. High 8.8

    CVE-2018-15193 · Gogs

    A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link.

    Published 8 Aug 2018 · NVD
  4. High 8.6

    CVE-2018-15192 · Gitea, Gogs

    An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

    Published 8 Aug 2018 · Fixed in 1.5.0 · NVD
  5. Medium 6.1

    CVE-2018-15178 · Gogs

    Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.

    Published 8 Aug 2018 · Fixed in 0.12 · NVD
  6. High 7.5

    CVE-2018-15132 · PHP

    An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories.

    Published 7 Aug 2018 · Fixed in 7.0.31, 7.1.20, 7.2.8 · NVD
  7. High 7.5

    CVE-2018-5390 · F5 BIG-IP

    Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

    Published 6 Aug 2018 · NVD
  8. Critical 9.8

    CVE-2017-9000 · HPE ArubaOS

    ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An unauthenticated user with network access to an Aruba mobility controller on TCP port 8080 or 8081 may be able…

    Published 6 Aug 2018 · Fixed in 6.5.3.3, 6.5.4.2, 8.1.0.4 · NVD
  9. Critical 9.8

    CVE-2017-6920 · Drupal

    Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.

    Published 6 Aug 2018 · Fixed in 8.3.4 · NVD
  10. Medium 6.1

    CVE-2017-12614 · Apache Airflow

    It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.

    Published 6 Aug 2018 · Fixed in 1.9.0 · NVD
  11. Medium 5.4

    CVE-2018-12607 · GitLab

    An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding.

    Published 3 Aug 2018 · Fixed in 10.7.6, 10.8.5, 11.0.1 · NVD
  12. Medium 5.4

    CVE-2018-12606 · GitLab

    An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature.

    Published 3 Aug 2018 · Fixed in 10.7.6, 10.8.5, 11.0.1 · NVD
  13. Medium 5.4

    CVE-2018-12605 · GitLab

    An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowing arbitrary protocols as a parameter.

    Published 3 Aug 2018 · Fixed in 10.7.6 · NVD
  14. Medium 6.5

    CVE-2018-14773 · Drupal

    An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support,…

    Published 3 Aug 2018 · Fixed in 8.5.6 · NVD
  15. High 7.5

    CVE-2018-14884 · PHP

    An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.

    Published 3 Aug 2018 · Fixed in 7.0.27, 7.1.13, 7.2.1 · NVD
  16. High 7.5

    CVE-2018-14883 · PHP

    An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.

    Published 3 Aug 2018 · Fixed in 7.0.31, 7.1.20, 7.2.8 · NVD
  17. Medium 5.5

    CVE-2018-14851 · PHP

    exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.

    Published 2 Aug 2018 · Fixed in 7.0.31, 7.1.20, 7.2.8 · NVD
  18. Critical 9.8

    CVE-2017-9120 · PHP

    PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.

    Published 2 Aug 2018 · Fixed in 7.4.23, 8.0.10 · NVD
  19. High 7.5

    CVE-2017-9118 · PHP

    PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.

    Published 2 Aug 2018 · Fixed in 7.4.27, 8.0.14, 8.1.1 · NVD
  20. Medium 5.9

    CVE-2018-8037 · Apache Tomcat

    If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and…

    Published 2 Aug 2018 · NVD
  21. High 7.5

    CVE-2018-1336 · Apache Tomcat

    An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

    Published 2 Aug 2018 · NVD
  22. Medium 4.9

    CVE-2018-2933 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks…

    Published 2 Aug 2018 · NVD
  23. Critical 9.1Actively exploited

    CVE-2018-14847 · MikroTik RouterOS

    MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

    Published 2 Aug 2018 · NVD
  24. High 7.5

    CVE-2018-8034 · Apache Tomcat

    The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

    Published 1 Aug 2018 · NVD
  25. High 7.5

    CVE-2016-8625 · curl

    curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

    Published 1 Aug 2018 · Fixed in 7.51.0 · NVD
  26. High 7.5

    CVE-2016-8623 · curl

    A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.

    Published 1 Aug 2018 · Fixed in 7.51.0 · NVD
  27. Critical 9.8

    CVE-2016-8620 · curl

    The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.

    Published 1 Aug 2018 · Fixed in 7.51.0 · NVD
  28. Critical 9.8

    CVE-2016-8619 · curl

    The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.

    Published 1 Aug 2018 · Fixed in 7.51.0 · NVD
  29. Medium 5.9

    CVE-2016-8616 · curl

    A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of…

    Published 1 Aug 2018 · Fixed in 7.51.0 · NVD
  30. High 7.5

    CVE-2016-8615 · curl

    A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

    Published 1 Aug 2018 · Fixed in 7.51.0 · NVD
  31. High 7.5

    CVE-2016-8621 · curl

    The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.

    Published 31 Jul 2018 · Fixed in 7.51.0 · NVD
  32. High 7.0

    CVE-2016-8617 · curl

    The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.

    Published 31 Jul 2018 · Fixed in 7.51.0 · NVD
  33. High 7.5

    CVE-2016-8624 · curl

    curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

    Published 31 Jul 2018 · Fixed in 7.51.0 · NVD
  34. Critical 9.8

    CVE-2016-8622 · curl

    The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl…

    Published 31 Jul 2018 · Fixed in 7.51.0 · NVD
  35. Critical 9.8

    CVE-2016-8618 · curl

    The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.

    Published 31 Jul 2018 · Fixed in 7.51.0 · NVD
  36. High 7.5

    CVE-2018-5544 · F5 BIG-IP

    When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters.

    Published 31 Jul 2018 · NVD
  37. High 7.5

    CVE-2016-9597 · libxml2

    It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.

    Published 30 Jul 2018 · NVD
  38. High 7.8

    CVE-2018-14678 · Xen

    An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.

    Published 28 Jul 2018 · NVD
  39. Medium 6.5

    CVE-2017-2629 · curl

    curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's…

    Published 27 Jul 2018 · Fixed in 7.53.0 · NVD
  40. Critical 9.9

    CVE-2017-2620 · Xen

    Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.

    Published 27 Jul 2018 · NVD
  41. High 7.4

    CVE-2017-12151 · Samba

    A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.

    Published 27 Jul 2018 · Fixed in 4.4.16, 4.5.14, 4.6.8 · NVD
  42. Medium 5.4

    CVE-2018-14606 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur via a Milestone name during a promotion.

    Published 27 Jul 2018 · Fixed in 10.8.7, 11.0.5, 11.1.2 · NVD
  43. Medium 5.4

    CVE-2018-14605 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the branch name during a Web IDE file commit.

    Published 27 Jul 2018 · Fixed in 10.8.7, 11.0.5, 11.1.2 · NVD
  44. Medium 6.1

    CVE-2018-14604 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the tooltip of the job inside the CI/CD pipeline.

    Published 27 Jul 2018 · Fixed in 10.8.7, 11.0.5, 11.1.2 · NVD
  45. High 8.8

    CVE-2018-14603 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. CSRF can occur in the Test feature of the System Hooks component.

    Published 27 Jul 2018 · Fixed in 10.8.7, 11.0.5, 11.1.2 · NVD
  46. High 7.5

    CVE-2018-14602 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames.

    Published 27 Jul 2018 · Fixed in 10.8.7, 11.0.5, 11.1.2 · NVD
  47. High 7.5

    CVE-2018-14601 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2. A Denial of Service can occur because Markdown rendering times are slow.

    Published 27 Jul 2018 · Fixed in 11.1.2 · NVD
  48. High 7.4

    CVE-2017-12150 · Samba

    It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.

    Published 26 Jul 2018 · Fixed in 4.4.16, 4.5.14, 4.6.8 · NVD
  49. Medium 6.5

    CVE-2017-12171 · Apache HTTP Server

    A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.

    Published 26 Jul 2018 · NVD
  50. High 7.1

    CVE-2017-12163 · Samba

    An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker.

    Published 26 Jul 2018 · Fixed in 4.4.16, 4.5.14, 4.6.8 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.