Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,931
- Published in 7 days
- 1,034
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,931 vulnerabilities- High 8.8
CVE-2017-15592 · Xen
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.
Published 18 Oct 2017 · NVD - Medium 6.5
CVE-2017-15591 · Xen
An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial of service (host OS crash) because of a missing comparison (of range start to range end) within the DMOP map/unmap implementation.
Published 18 Oct 2017 · NVD - High 8.8
CVE-2017-15590 · Xen
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.
Published 18 Oct 2017 · NVD - Medium 6.5
CVE-2017-15589 · Xen
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.
Published 18 Oct 2017 · NVD - High 7.8
CVE-2017-15588 · Xen
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.
Published 18 Oct 2017 · NVD - High 7.5
CVE-2017-15577 · Redmine
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
Published 18 Oct 2017 · NVD - High 7.5
CVE-2017-15576 · Redmine
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
Published 18 Oct 2017 · NVD - High 7.3
CVE-2017-15575 · Redmine
In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
Published 18 Oct 2017 · NVD - Medium 6.1
CVE-2017-15574 · Redmine
In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment.
Published 18 Oct 2017 · NVD - Medium 6.1
CVE-2017-15573 · Redmine
In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki content.
Published 18 Oct 2017 · NVD - High 7.5
CVE-2017-15572 · Redmine
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
Published 18 Oct 2017 · NVD - Medium 6.1
CVE-2017-15571 · Redmine
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.
Published 18 Oct 2017 · NVD - Medium 6.1
CVE-2017-15570 · Redmine
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.
Published 18 Oct 2017 · NVD - Medium 6.1
CVE-2017-15569 · Redmine
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
Published 18 Oct 2017 · NVD - Medium 6.1
CVE-2017-15568 · Redmine
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.
Published 18 Oct 2017 · NVD - Medium 6.1
CVE-2016-10515 · Redmine
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.
Published 18 Oct 2017 · NVD - Critical 9.8
CVE-2014-9487 · MediaWiki
The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053.
Published 17 Oct 2017 · NVD - High 8.8
CVE-2015-7504 · Xen
Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
Published 16 Oct 2017 · NVD - High 8.8
CVE-2016-4461 · Apache Struts
Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
Published 16 Oct 2017 · Fixed in 2.3.29 · NVD - Medium 6.1
CVE-2017-15374 · Shopware
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing…
Published 16 Oct 2017 · NVD - Critical 9.8
CVE-2017-12629 · Apache Solr
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for…
Published 14 Oct 2017 · NVD - Medium 4.7
CVE-2016-9263 · WordPress
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
Published 12 Oct 2017 · NVD - Medium 5.3
CVE-2017-12849 · Silverstripe CMS
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.
Published 12 Oct 2017 · NVD - High 7.5
CVE-2017-15286 · SQLite
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.
Published 12 Oct 2017 · NVD - Medium 5.4
CVE-2017-15284 · October CMS
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
Published 12 Oct 2017 · NVD - High 8.8
CVE-2017-15281 · ImageMagick
ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)."
Published 12 Oct 2017 · NVD - Medium 5.5
CVE-2017-15280 · Umbraco CMS
XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
Published 12 Oct 2017 · NVD - Medium 5.4
CVE-2017-15279 · Umbraco CMS
Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs.
Published 12 Oct 2017 · NVD - Medium 6.5
CVE-2017-15277 · ImageMagick
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
Published 12 Oct 2017 · NVD - Medium 6.1
CVE-2017-1503 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive…
Published 10 Oct 2017 · NVD - Medium 6.5
CVE-2017-15218 · ImageMagick
ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.
Published 10 Oct 2017 · NVD - Medium 6.5
CVE-2017-15217 · ImageMagick
ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.
Published 10 Oct 2017 · NVD - High 7.0
CVE-2015-8239 · sudo
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Published 10 Oct 2017 · NVD - High 7.5
CVE-2015-7384 · Node.js
Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
Published 10 Oct 2017 · NVD - High 7.8
CVE-2014-0047 · Docker Engine
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.
Published 6 Oct 2017 · NVD - High 7.5
CVE-2017-1000254 · curl
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the…
Published 6 Oct 2017 · NVD - High 7.5
CVE-2017-15033 · ImageMagick
ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.
Published 5 Oct 2017 · NVD - Critical 9.8
CVE-2017-15032 · ImageMagick
ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.
Published 5 Oct 2017 · NVD - High 8.6
CVE-2017-12246 · Cisco ASA and Firepower Threat Defense
A vulnerability in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of the HTTP header. An attacker could exploit this vulnerability…
Published 5 Oct 2017 · NVD - High 8.8
CVE-2017-15017 · ImageMagick
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.
Published 5 Oct 2017 · NVD - High 8.8
CVE-2017-15016 · ImageMagick
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.
Published 5 Oct 2017 · NVD - High 8.8
CVE-2017-15015 · ImageMagick
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.
Published 5 Oct 2017 · NVD - High 8.8
CVE-2017-1000120 · Frappe Framework
[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
Published 5 Oct 2017 · NVD - High 7.2
CVE-2017-1000119 · October CMS
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
Published 5 Oct 2017 · NVD - Medium 6.5
CVE-2017-1000101 · curl
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could…
Published 5 Oct 2017 · NVD - Medium 6.5
CVE-2017-1000100 · curl
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the…
Published 5 Oct 2017 · NVD - Medium 6.5
CVE-2017-1000099 · curl
When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the…
Published 5 Oct 2017 · NVD - Critical 9.8
CVE-2017-14491 · HPE ArubaOS
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
Published 4 Oct 2017 · Fixed in 6.5.3.3, 6.5.4.2, 8.1.0.4 · NVD - High 8.1Actively exploited
CVE-2017-12617 · Apache Tomcat
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Published 4 Oct 2017 · Fixed in 8.0.47, 8.5.23, 9.0.1 · NVD - Critical 9.8
CVE-2017-12166 · OpenVPN
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
Published 4 Oct 2017 · Fixed in 2.3.18, 2.4.4 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.