UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,928
Published in 7 days
1,033
Critical in 30 days
362
Actively exploited
423

Latest vulnerabilities

39,928 vulnerabilities
  1. Medium 5.4

    CVE-2018-1288 · Apache Kafka

    In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

    Published 26 Jul 2018 · NVD
  2. Medium 6.8

    CVE-2017-12610 · Apache Kafka

    In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.

    Published 26 Jul 2018 · NVD
  3. High 8.1

    CVE-2018-5542 · F5 BIG-IP

    F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server.

    Published 25 Jul 2018 · NVD
  4. Low 3.7

    CVE-2018-5538 · F5 BIG-IP

    On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable "dnsexpress.notifyport" is set to any value other than the default of "0".

    Published 25 Jul 2018 · NVD
  5. Medium 5.3

    CVE-2018-5537 · F5 BIG-IP

    A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual server is configured with a HTML or a Rewrite profile. TMM may restart while processing some specially prepared HTML content from the back end.

    Published 25 Jul 2018 · NVD
  6. High 7.5

    CVE-2018-5536 · F5 BIG-IP

    A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server configured with an APM per-request policy object and cause a memory leak in the APM module.

    Published 25 Jul 2018 · NVD
  7. High 7.4

    CVE-2018-5531 · F5 BIG-IP

    Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers can cause a denial of service for VCMP guest and host systems. Attack must be sourced from adjacent network (layer 2).

    Published 25 Jul 2018 · NVD
  8. High 7.5

    CVE-2018-5530 · F5 BIG-IP

    F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb".

    Published 25 Jul 2018 · NVD
  9. Medium 6.5

    CVE-2018-6972 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-201806401-BG, 6.5 before ESXi650-201806401-BG, 6.0 before ESXi600-201806401-BG and 5.5 before ESXi550-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain a denial-of-service vulnerability due to NULL pointer dereference issue in RPC handler. Successful exploitation of this issue may allow attackers with normal user privileges…

    Published 25 Jul 2018 · NVD
  10. Medium 5.9

    CVE-2017-18104 · Jira

    The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a specified JQL query.

    Published 24 Jul 2018 · Fixed in 7.6.7, 7.11.0 · NVD
  11. Medium 5.4

    CVE-2018-1999007 · Jenkins

    A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.

    Published 23 Jul 2018 · NVD
  12. Medium 4.3

    CVE-2018-1999006 · Jenkins

    A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the most recent installation/upgrade.

    Published 23 Jul 2018 · NVD
  13. Medium 5.4

    CVE-2018-1999005 · Jenkins

    A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

    Published 23 Jul 2018 · NVD
  14. Medium 4.3

    CVE-2018-1999004 · Jenkins

    A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.

    Published 23 Jul 2018 · NVD
  15. Medium 4.3

    CVE-2018-1999003 · Jenkins

    A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds.

    Published 23 Jul 2018 · NVD
  16. High 7.5

    CVE-2018-1999002 · Jenkins

    A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

    Published 23 Jul 2018 · NVD
  17. High 8.8

    CVE-2018-1999001 · Jenkins

    A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to…

    Published 23 Jul 2018 · NVD
  18. Critical 9.8

    CVE-2018-1999019 · Chamilo LMS

    Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.

    Published 23 Jul 2018 · NVD
  19. Medium 6.5

    CVE-2018-1999015 · FFmpeg

    FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.

    Published 23 Jul 2018 · NVD
  20. Medium 6.5

    CVE-2018-1999014 · FFmpeg

    FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.

    Published 23 Jul 2018 · NVD
  21. Medium 6.5

    CVE-2018-1999013 · FFmpeg

    FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.

    Published 23 Jul 2018 · NVD
  22. Medium 6.5

    CVE-2018-1999012 · FFmpeg

    FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in…

    Published 23 Jul 2018 · NVD
  23. High 8.8

    CVE-2018-1999011 · FFmpeg

    FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in…

    Published 23 Jul 2018 · NVD
  24. Critical 9.8

    CVE-2018-1999010 · FFmpeg

    FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in cced03dd667a5df6df8fd40d8de0bff477ee02e8 and later.

    Published 23 Jul 2018 · Fixed in 3.4.3 · NVD
  25. Medium 5.4

    CVE-2018-1999008 · October CMS

    October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS).…

    Published 23 Jul 2018 · Fixed in 1.0.437 · NVD
  26. Critical 9.8

    CVE-2018-14551 · ImageMagick

    The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.

    Published 23 Jul 2018 · NVD
  27. High 7.5

    CVE-2018-5006 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 20 Jul 2018 · NVD
  28. High 7.5

    CVE-2018-5004 · Adobe Experience Manager

    Adobe Experience Manager versions 6.2 and 6.3 have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 20 Jul 2018 · Fixed in 6.4.0 · NVD
  29. High 7.5

    CVE-2018-12809 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 20 Jul 2018 · NVD
  30. Medium 6.5

    CVE-2018-14437 · ImageMagick

    ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c.

    Published 20 Jul 2018 · NVD
  31. Medium 6.5

    CVE-2018-14436 · ImageMagick

    ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c.

    Published 20 Jul 2018 · NVD
  32. Medium 6.5

    CVE-2018-14435 · ImageMagick

    ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c.

    Published 20 Jul 2018 · NVD
  33. Medium 6.5

    CVE-2018-14434 · ImageMagick

    ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c.

    Published 20 Jul 2018 · NVD
  34. Critical 9.8Actively exploited

    CVE-2018-7602 · Drupal

    A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being…

    Published 19 Jul 2018 · Fixed in 7.59, 8.4.8, 8.5.3 · NVD
  35. High 7.5

    CVE-2018-5535 · F5 BIG-IP

    On F5 BIG-IP 14.0.0, 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.5.1-11.6.3 specifically crafted HTTP responses, when processed by a Virtual Server with an associated QoE profile that has Video enabled, may cause TMM to incorrectly buffer response data causing the TMM to restart resulting in a Denial of Service.

    Published 19 Jul 2018 · NVD
  36. High 7.5

    CVE-2018-5534 · F5 BIG-IP

    Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward proxy traffic.

    Published 19 Jul 2018 · NVD
  37. High 7.5

    CVE-2018-5533 · F5 BIG-IP

    Under certain conditions on F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward proxy traffic.

    Published 19 Jul 2018 · NVD
  38. Medium 5.3

    CVE-2018-5532 · F5 BIG-IP

    On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be resolved by the cache even after the parent server revokes the record, if the DNS Cache is receiving a stream of requests for the cached name.

    Published 19 Jul 2018 · NVD
  39. Medium 6.5

    CVE-2018-14404 · libxml2

    A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

    Published 19 Jul 2018 · NVD
  40. Medium 6.5

    CVE-2018-14395 · FFmpeg

    libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio format.

    Published 19 Jul 2018 · NVD
  41. Medium 6.5

    CVE-2018-14394 · FFmpeg

    libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file.

    Published 19 Jul 2018 · Fixed in 4.0.2 · NVD
  42. Critical 9.8

    CVE-2018-14364 · GitLab

    GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component.

    Published 18 Jul 2018 · Fixed in 10.7.7, 10.8.6, 11.0.4 · NVD
  43. High 7.5

    CVE-2018-8011 · Apache HTTP Server

    By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).

    Published 18 Jul 2018 · NVD
  44. Medium 6.1

    CVE-2018-5232 · Jira

    The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuetype parameter.

    Published 18 Jul 2018 · Fixed in 7.6.7, 7.10.1 · NVD
  45. Low 2.8

    CVE-2018-3084 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell: Core / Client). Supported versions that are affected are 8.0.11 and prior. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker.…

    Published 18 Jul 2018 · NVD
  46. Low 2.7

    CVE-2018-3082 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server…

    Published 18 Jul 2018 · NVD
  47. Medium 5.0

    CVE-2018-3081 · MariaDB, MySQL

    Vulnerability in the MySQL Client component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior, 5.7.22 and prior and 8.0.11 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result…

    Published 18 Jul 2018 · Fixed in 10.0.35, 10.1.33, 10.2.15 · NVD
  48. Medium 4.9

    CVE-2018-3080 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jul 2018 · NVD
  49. Medium 4.9

    CVE-2018-3079 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Jul 2018 · NVD
  50. Medium 4.9

    CVE-2018-3078 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jul 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.