Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,931
- Published in 7 days
- 1,035
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,931 vulnerabilities- Critical 9.8
CVE-2017-8817 · curl
The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.
Published 29 Nov 2017 · NVD - Critical 9.8
CVE-2017-8816 · curl
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
Published 29 Nov 2017 · NVD - High 7.5
CVE-2017-17058 · WooCommerce
WooCommerce: Path Traversal
Published 29 Nov 2017 · Fixed in 4.0 · WPVulnerability - Medium 6.5
CVE-2017-17046 · Xen
An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled.
Published 28 Nov 2017 · NVD - High 8.8
CVE-2017-17045 · Xen
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors.
Published 28 Nov 2017 · NVD - Medium 6.5
CVE-2017-17044 · Xen
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishandling of Populate on Demand (PoD) errors.
Published 28 Nov 2017 · NVD - High 7.5
CVE-2017-15275 · Samba
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.
Published 27 Nov 2017 · Fixed in 4.5.15, 4.6.11, 4.7.3 · NVD - Critical 9.8
CVE-2017-14746 · Samba
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.
Published 27 Nov 2017 · Fixed in 4.5.15, 4.6.11, 4.7.3 · NVD - High 8.8
CVE-2017-18596 · Elementor
Elementor Website Builder – more than just a page builder: Improper Privilege Management
Published 27 Nov 2017 · Fixed in 1.8.0 · WPVulnerability - High 7.5
CVE-2017-16944 · Exim
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
Published 25 Nov 2017 · NVD - Critical 9.8
CVE-2017-16943 · Exim
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
Published 25 Nov 2017 · NVD - High 8.8
CVE-2017-16941 · October CMS
October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an…
Published 25 Nov 2017 · NVD - High 7.5
CVE-2017-16932 · libxml2
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Published 23 Nov 2017 · NVD - Critical 9.8
CVE-2017-16931 · libxml2
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
Published 23 Nov 2017 · NVD - Medium 6.7
CVE-2017-12172 · PostgreSQL
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many…
Published 22 Nov 2017 · NVD - Medium 6.5
CVE-2017-15099 · PostgreSQL
INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.
Published 22 Nov 2017 · NVD - Medium 5.4
CVE-2017-7736 · Fortinet FortiWeb
A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import.
Published 22 Nov 2017 · NVD - High 8.1
CVE-2017-15098 · PostgreSQL
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.
Published 22 Nov 2017 · NVD - Critical 9.8
CVE-2017-16840 · FFmpeg
The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.
Published 21 Nov 2017 · NVD - High 8.8
CVE-2017-16544 · VMware ESXi
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Published 20 Nov 2017 · NVD - Medium 4.3
CVE-2017-15110 · Moodle
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.
Published 20 Nov 2017 · NVD - Unrated
WPV-d2188ae68dcd · Yoast SEO
Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Published 20 Nov 2017 · Fixed in 5.8.0 · WPVulnerability - Critical 9.1
CVE-2017-1000190 · Apache Solr
SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.
Published 17 Nov 2017 · NVD - High 7.5
CVE-2017-4928 · VMware vCenter Server
The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.
Published 17 Nov 2017 · NVD - High 7.5
CVE-2017-4927 · VMware vCenter Server
VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service.
Published 17 Nov 2017 · Fixed in 6.0_u3c, 6.5_u1 · NVD - Critical 9.8
CVE-2017-1000158 · Python
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
Published 17 Nov 2017 · Fixed in 2.7.15, 3.4.8, 3.5.5 · NVD - Critical 9.8
CVE-2017-1000197 · October CMS
October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server.
Published 17 Nov 2017 · NVD - Critical 9.8
CVE-2017-1000196 · October CMS
October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server.
Published 17 Nov 2017 · NVD - High 7.5
CVE-2017-1000195 · October CMS
October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.
Published 17 Nov 2017 · NVD - Critical 9.8
CVE-2017-1000194 · October CMS
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.
Published 17 Nov 2017 · NVD - Medium 6.1
CVE-2017-1000193 · October CMS
October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.
Published 17 Nov 2017 · NVD - High 8.1
CVE-2017-16871 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Code Injection
Published 17 Nov 2017 · NVD, WPVulnerability - High 8.1
CVE-2017-16870 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Server-Side Request Forgery (SSRF)
Published 17 Nov 2017 · NVD, WPVulnerability - Critical 9.1
CVE-2017-8807 · Varnish Cache
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
Published 16 Nov 2017 · Fixed in 5.2.1 · NVD - High 8.8
CVE-2017-18356 · WooCommerce
WooCommerce: Code Injection
Published 16 Nov 2017 · Fixed in 3.2.4 · NVD, WPVulnerability - Medium 4.8
CVE-2017-16842 · Yoast SEO
Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting
Published 16 Nov 2017 · Fixed in 5.8.0 · WPVulnerability - High 7.5
CVE-2017-8815 · MediaWiki
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
Published 15 Nov 2017 · NVD - High 7.5
CVE-2017-8814 · MediaWiki
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
Published 15 Nov 2017 · NVD - Medium 5.3
CVE-2017-8812 · MediaWiki
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline.
Published 15 Nov 2017 · NVD - Medium 6.1
CVE-2017-8811 · MediaWiki
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.
Published 15 Nov 2017 · NVD - High 7.5
CVE-2017-8810 · MediaWiki
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
Published 15 Nov 2017 · NVD - Critical 9.8
CVE-2017-8809 · MediaWiki
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.
Published 15 Nov 2017 · NVD - Medium 6.1
CVE-2017-8808 · MediaWiki
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping.
Published 15 Nov 2017 · NVD - High 7.5
CVE-2017-8700 · .NET
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".
Published 15 Nov 2017 · NVD - High 8.8
CVE-2017-11879 · .NET
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Published 15 Nov 2017 · NVD - High 7.2
CVE-2017-12636 · Apache CouchDB
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public…
Published 14 Nov 2017 · Fixed in 1.7.0 · NVD - Critical 9.8
CVE-2017-12635 · Apache CouchDB
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this…
Published 14 Nov 2017 · Fixed in 1.7.0 · NVD - High 7.5
CVE-2016-8610 · OpenSSL, Oracle WebLogic Server, Palo Alto Networks PAN-OS
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Published 13 Nov 2017 · NVD - Medium 4.3
CVE-2017-16804 · Redmine
In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.
Published 13 Nov 2017 · Fixed in 3.2.7 · NVD - Medium 6.1
CVE-2017-7739 · Fortinet FortiOS
A reflected Cross-site Scripting (XSS) vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously crafted URL to the victim.
Published 13 Nov 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.