Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,928
- Published in 7 days
- 1,033
- Critical in 30 days
- 362
- Actively exploited
- 423
Latest vulnerabilities
39,928 vulnerabilities- Medium 4.3
CVE-2018-1000514 · LimeSurvey
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x.
Published 26 Jun 2018 · NVD - Medium 4.8
CVE-2018-1000513 · LimeSurvey
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x.
Published 26 Jun 2018 · NVD - Medium 4.3
CVE-2018-1000503 · MyBB
MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.
Published 26 Jun 2018 · Fixed in 1.8.15 · NVD - High 7.2
CVE-2018-1000502 · MyBB
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have access to admin panel. This vulnerability appears to have been fixed in 1.8.15.
Published 26 Jun 2018 · Fixed in 1.8.15 · NVD - Critical 9.8
CVE-2017-7657 · Eclipse Jetty
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request.…
Published 26 Jun 2018 · Fixed in 9.3.24, 9.4.11 · NVD - High 7.5
CVE-2017-7656 · Eclipse Jetty
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9…
Published 26 Jun 2018 · Fixed in 9.3.24, 9.4.11 · NVD - Critical 9.8
CVE-2018-12882 · PHP
exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
Published 26 Jun 2018 · NVD - High 7.2
CVE-2018-1000504 · Redirection (WordPress plugin)
Redirection: Open Redirect
Published 26 Jun 2018 · Fixed in 2.8 · WPVulnerability - High 7.5
CVE-2018-11040 · Oracle WebLogic Server
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when…
Published 25 Jun 2018 · NVD - Medium 5.9
CVE-2018-11039 · Oracle WebLogic Server
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site…
Published 25 Jun 2018 · NVD - High 8.8
CVE-2018-12538 · Eclipse Jetty
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Published 22 Jun 2018 · NVD - Critical 9.8
CVE-2018-12678 · Portainer
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.
Published 22 Jun 2018 · Fixed in 1.18.0 · NVD - High 7.5
CVE-2018-12642 · Froxlor
Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.
Published 22 Jun 2018 · NVD - High 8.8
CVE-2018-12613 · phpMyAdmin
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an…
Published 21 Jun 2018 · Fixed in 4.8.2 · NVD - Medium 6.1
CVE-2018-12581 · phpMyAdmin
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
Published 21 Jun 2018 · Fixed in 4.8.2 · NVD - High 7.5
CVE-2017-2669 · Dovecot
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all…
Published 21 Jun 2018 · NVD - High 8.8
CVE-2018-12600 · ImageMagick
In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file.
Published 20 Jun 2018 · NVD - High 8.8
CVE-2018-12599 · ImageMagick
In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file.
Published 20 Jun 2018 · NVD - Unrated
WPV-367f190b7403 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 20 Jun 2018 · Fixed in 2.8 · WPVulnerability - High 7.5
CVE-2018-1061 · Python
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
Published 19 Jun 2018 · Fixed in 2.7.15, 3.4.9 · NVD - High 7.5
CVE-2018-1333 · Apache HTTP Server
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).
Published 18 Jun 2018 · NVD - High 7.5
CVE-2018-1060 · Python
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
Published 18 Jun 2018 · Fixed in 3.4.9, 3.5.6, 3.6.5 · NVD - Medium 6.5
CVE-2018-12460 · FFmpeg
libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI file to MPEG4, leading to a denial of service, related to idctdsp.c and mpegvideo.c.
Published 15 Jun 2018 · NVD - Medium 6.5
CVE-2018-12459 · FFmpeg
An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.
Published 15 Jun 2018 · NVD - Medium 6.5
CVE-2018-12458 · FFmpeg
An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.
Published 15 Jun 2018 · NVD - High 7.5
CVE-2018-7167 · Node.js
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of…
Published 13 Jun 2018 · Fixed in 6.14.3, 8.11.3, 9.11.2 · NVD - High 7.5
CVE-2018-7164 · Node.js
Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the…
Published 13 Jun 2018 · Fixed in 9.11.2, 10.4.1 · NVD - High 7.5
CVE-2018-7162 · Node.js
All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.
Published 13 Jun 2018 · Fixed in 9.11.2, 10.4.1 · NVD - High 7.5
CVE-2018-7161 · Node.js
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by…
Published 13 Jun 2018 · Fixed in 8.11.3, 9.11.2, 10.4.1 · NVD - High 7.5
CVE-2018-0732 · Node.js, OpenSSL
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected…
Published 12 Jun 2018 · Fixed in 8.8.1, 8.11.4, 10.9.0 · NVD - Critical 9.8
CVE-2016-9063 · Python
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
Published 11 Jun 2018 · Fixed in 3.4.7, 3.5.4, 3.6.2 · NVD - Medium 4.8
CVE-2018-12100 · Sonatype Nexus Repository
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
Published 11 Jun 2018 · Fixed in 3.12.0 · NVD - Medium 6.1
CVE-2018-12099 · Grafana
Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.
Published 11 Jun 2018 · NVD - Medium 5.3
CVE-2018-11409 · Splunk Enterprise
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
Published 8 Jun 2018 · NVD - High 7.5Actively exploited
CVE-2018-0296 · Cisco ASA and Firepower Threat Defense
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by…
Published 7 Jun 2018 · Fixed in 9.7.1.24, 9.8.2.28, 9.9.2.1 · NVD - Medium 4.3
CVE-2018-1000195 · Jenkins
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
Published 5 Jun 2018 · NVD - High 8.1
CVE-2018-1000194 · Jenkins
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Published 5 Jun 2018 · NVD - Medium 4.3
CVE-2018-1000193 · Jenkins
A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI.
Published 5 Jun 2018 · NVD - Medium 4.3
CVE-2018-1000192 · Jenkins
A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
Published 5 Jun 2018 · NVD - High 7.5
CVE-2018-1000180 · Oracle WebLogic Server
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
Published 5 Jun 2018 · NVD - High 7.5
CVE-2017-16046 · MariaDB
`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Published 4 Jun 2018 · NVD - Medium 6.5
CVE-2017-16024 · Node.js
The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.
Published 4 Jun 2018 · Fixed in 0.11.9 · NVD - Medium 5.5
CVE-2018-1002100 · Kubernetes
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
Published 2 Jun 2018 · NVD - Medium 6.5
CVE-2018-11656 · ImageMagick
In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
Published 1 Jun 2018 · NVD - Medium 6.5
CVE-2018-11655 · ImageMagick
In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function GetImagePixelCache in MagickCore/cache.c, which allows attackers to cause a denial of service via a crafted CALS image file.
Published 1 Jun 2018 · NVD - Medium 4.3
CVE-2018-5525 · F5 BIG-IP
A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive customer data.
Published 1 Jun 2018 · Fixed in 12.1.3 · NVD - Medium 5.3
CVE-2018-5524 · F5 BIG-IP
Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL or Server SSL profiles which make use of network hardware security module (HSM) functionality are exposed and impacted by this issue.
Published 1 Jun 2018 · NVD - High 7.2
CVE-2018-5523 · F5 BIG-IP
On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
Published 1 Jun 2018 · NVD - Medium 5.9
CVE-2018-5522 · F5 BIG-IP
On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash.
Published 1 Jun 2018 · NVD - Medium 6.1
CVE-2018-5521 · F5 BIG-IP
On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially exposing clients to XSS.
Published 1 Jun 2018 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.