UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,931
Published in 7 days
1,036
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,931 vulnerabilities
  1. Medium 6.8

    CVE-2018-2583 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Stored Procedure). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional…

    Published 18 Jan 2018 · NVD
  2. Medium 6.5

    CVE-2018-2582 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a…

    Published 18 Jan 2018 · NVD
  3. Medium 4.7

    CVE-2018-2581 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability…

    Published 18 Jan 2018 · NVD
  4. Low 3.7

    CVE-2018-2579 · Java

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit.…

    Published 18 Jan 2018 · NVD
  5. Medium 4.9

    CVE-2018-2576 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jan 2018 · NVD
  6. Medium 6.5

    CVE-2018-2573 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: GIS). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 18 Jan 2018 · NVD
  7. Medium 4.9

    CVE-2018-2565 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jan 2018 · NVD
  8. High 7.1

    CVE-2018-2562 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 18 Jan 2018 · Fixed in 10.0.34, 10.1.31, 10.2.13 · NVD
  9. High 7.5

    CVE-2018-5764 · rsync

    The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

    Published 17 Jan 2018 · Fixed in 3.1.3 · NVD
  10. Medium 5.3

    CVE-2017-16865 · Jira

    The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF). When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information.

    Published 17 Jan 2018 · Fixed in 7.6.1 · NVD
  11. Unrated

    WPV-f6e223f56671 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 17 Jan 2018 · Fixed in 2.2.0 · WPVulnerability
  12. Medium 6.1

    CVE-2018-5712 · PHP

    An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

    Published 16 Jan 2018 · NVD
  13. Medium 5.5

    CVE-2018-5711 · PHP

    gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

    Published 16 Jan 2018 · NVD
  14. Unrated

    WPV-bf65ffde71b0 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 16 Jan 2018 · Fixed in 2.2.0 · WPVulnerability
  15. Medium 5.3

    CVE-2018-5682 · PrestaShop

    PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message.

    Published 13 Jan 2018 · NVD
  16. Medium 5.4

    CVE-2018-5681 · PrestaShop

    PrestaShop 1.7.2.4 has XSS via source-code editing on the "Pages > Edit page" screen.

    Published 13 Jan 2018 · NVD
  17. Medium 6.5

    CVE-2017-18029 · ImageMagick

    In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.

    Published 12 Jan 2018 · NVD
  18. Medium 6.5

    CVE-2017-18028 · ImageMagick

    In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a denial of service via a crafted file.

    Published 12 Jan 2018 · NVD
  19. Medium 6.5

    CVE-2017-18027 · ImageMagick

    In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.

    Published 12 Jan 2018 · NVD
  20. Medium 6.1

    CVE-2017-16864 · Jira

    The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.

    Published 12 Jan 2018 · Fixed in 7.4.2 · NVD
  21. Medium 4.3

    CVE-2017-16862 · Jira

    The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability.

    Published 12 Jan 2018 · Fixed in 7.6.2 · NVD
  22. Medium 6.1

    CVE-2017-14594 · Jira

    The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter.

    Published 12 Jan 2018 · Fixed in 7.2.12, 7.6.1 · NVD
  23. Medium 6.5

    CVE-2018-5358 · ImageMagick

    ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c.

    Published 12 Jan 2018 · NVD
  24. Medium 6.5

    CVE-2018-5357 · ImageMagick

    ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c.

    Published 12 Jan 2018 · NVD
  25. Medium 5.9

    CVE-2017-17841 · Palo Alto Networks PAN-OS

    Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gateway, might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

    Published 10 Jan 2018 · NVD
  26. Medium 6.1

    CVE-2017-16878 · Palo Alto Networks PAN-OS

    Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to inject arbitrary web script or HTML by leveraging an unspecified configuration.

    Published 10 Jan 2018 · Fixed in 8.0.7 · NVD
  27. Medium 6.1

    CVE-2017-15941 · Palo Alto Networks PAN-OS

    Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 10 Jan 2018 · Fixed in 7.0.19, 7.1.14, 8.0.7 · NVD
  28. Medium 6.1

    CVE-2016-6810 · Apache ActiveMQ

    In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.

    Published 10 Jan 2018 · Fixed in 5.14.2 · NVD
  29. High 8.8

    CVE-2017-18026 · Redmine

    Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.

    Published 10 Jan 2018 · Fixed in 3.2.9, 3.3.6, 3.4.4 · NVD
  30. Medium 6.5

    CVE-2018-0785 · .NET

    ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability".

    Published 10 Jan 2018 · NVD
  31. High 8.8

    CVE-2018-0784 · .NET

    ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0808.

    Published 10 Jan 2018 · NVD
  32. Medium 5.5

    CVE-2015-1208 · FFmpeg

    Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.

    Published 9 Jan 2018 · Fixed in 2.4.6 · NVD
  33. Medium 6.5

    CVE-2018-5301 · Magento / Adobe Commerce

    Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

    Published 8 Jan 2018 · Fixed in 2.0.10, 2.1.2 · NVD
  34. Medium 5.4

    CVE-2018-5281 · SonicWall SonicOS

    SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.

    Published 8 Jan 2018 · NVD
  35. Medium 5.4

    CVE-2018-5280 · SonicWall SonicOS

    SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens.

    Published 8 Jan 2018 · NVD
  36. High 8.8

    CVE-2018-5248 · ImageMagick

    In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function.

    Published 5 Jan 2018 · NVD
  37. Medium 6.5

    CVE-2018-5247 · ImageMagick

    In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c.

    Published 5 Jan 2018 · NVD
  38. Medium 6.5

    CVE-2018-5246 · ImageMagick

    In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.

    Published 5 Jan 2018 · NVD
  39. Medium 6.5

    CVE-2017-18022 · ImageMagick

    In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c.

    Published 5 Jan 2018 · NVD
  40. Medium 6.5

    CVE-2018-5244 · Xen

    In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a vcpu is destroyed. This allows guest OS administrators to cause a denial of service (host OS memory consumption) by rebooting many times.

    Published 5 Jan 2018 · NVD
  41. Medium 6.5

    CVE-2014-8540 · GitLab

    The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.

    Published 5 Jan 2018 · Fixed in 7.4.3 · NVD
  42. Critical 9.8

    CVE-2017-15714 · Apache OFBiz

    The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "__format=%27;alert(%27xss%27)" to the URL an alert window would execute.

    Published 4 Jan 2018 · NVD
  43. Medium 5.6

    CVE-2017-5753 · VMware ESXi

    Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

    Published 4 Jan 2018 · NVD
  44. Medium 6.5

    CVE-2017-1000460 · FFmpeg

    In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.

    Published 3 Jan 2018 · NVD
  45. Critical 9.8

    CVE-2017-1000480 · Smarty

    Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.

    Published 3 Jan 2018 · Fixed in 3.1.32 · NVD
  46. High 8.8

    CVE-2017-1000479 · pfSense

    pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed…

    Published 3 Jan 2018 · NVD
  47. Medium 6.5

    CVE-2017-1000476 · ImageMagick

    ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service.

    Published 3 Jan 2018 · NVD
  48. Medium 6.5

    CVE-2017-1000490 · Mautic

    Mautic users able to download any files from server using filemanager

    Published 3 Jan 2018 · Fixed in 2.12.0 · NVD, Project advisories (GitHub)
  49. High 8.1

    CVE-2017-1000489 · Mautic

    Disabled users able to log in with third party SSO plugin

    Published 3 Jan 2018 · Fixed in 2.12.0 · NVD, Project advisories (GitHub)
  50. Medium 6.1

    CVE-2017-1000488 · Mautic

    Inline JS XSS vulnerability

    Published 3 Jan 2018 · Fixed in 2.12.0 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.