Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,931
- Published in 7 days
- 1,034
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,931 vulnerabilities- Medium 6.5
CVE-2017-14990 · WordPress
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
Published 3 Oct 2017 · NVD - Medium 6.5
CVE-2017-14989 · ImageMagick
A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.
Published 3 Oct 2017 · NVD - Medium 6.1
CVE-2017-11479 · Kibana
Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Published 29 Sept 2017 · NVD - High 7.5
CVE-2017-14849 · Node.js
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Published 28 Sept 2017 · NVD - High 8.8
CVE-2017-14767 · FFmpeg
The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
Published 27 Sept 2017 · NVD - Medium 6.5
CVE-2017-14741 · ImageMagick
The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.
Published 26 Sept 2017 · NVD - High 7.5
CVE-2017-14739 · ImageMagick
The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors.
Published 26 Sept 2017 · NVD - Critical 9.8
CVE-2015-8707 · Magento / Adobe Commerce
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
Published 26 Sept 2017 · NVD - Medium 6.1
CVE-2015-5169 · Apache Struts
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Published 25 Sept 2017 · NVD - Medium 6.1
CVE-2017-14726 · WordPress
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
Published 23 Sept 2017 · NVD - Medium 5.4
CVE-2017-14725 · WordPress
Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14724 · WordPress
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
Published 23 Sept 2017 · NVD - Critical 9.8
CVE-2017-14723 · WordPress
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
Published 23 Sept 2017 · NVD - High 7.5
CVE-2017-14722 · WordPress
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14721 · WordPress
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14720 · WordPress
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
Published 23 Sept 2017 · NVD - High 7.5
CVE-2017-14719 · WordPress
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
Published 23 Sept 2017 · NVD - Medium 6.1
CVE-2017-14718 · WordPress
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
Published 23 Sept 2017 · NVD - Medium 6.5
CVE-2017-14684 · ImageMagick
In ImageMagick 7.0.7-4 Q16, a memory leak vulnerability was found in the function ReadVIPSImage in coders/vips.c, which allows attackers to cause a denial of service (memory consumption in ResizeMagickMemory in MagickCore/memory.c) via a crafted file.
Published 22 Sept 2017 · NVD - High 8.8
CVE-2017-14682 · ImageMagick
GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document, a different vulnerability than CVE-2017-10928.
Published 21 Sept 2017 · NVD - Critical 9.8
CVE-2017-12170 · Pure-FTPd
Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was ignored after update and service started running with default configuration. This has security implications because of overriding security-related configuration. This issue doesn't affect upstream version of pure-ftpd.
Published 21 Sept 2017 · NVD - Critical 9.8
CVE-2017-14626 · ImageMagick
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.
Published 21 Sept 2017 · NVD - Critical 9.8
CVE-2017-14625 · ImageMagick
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.
Published 21 Sept 2017 · NVD - Critical 9.8
CVE-2017-14624 · ImageMagick
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.
Published 21 Sept 2017 · NVD - High 7.5
CVE-2017-14616 · WatchGuard Fireware OS
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login attempts, UI management of the device becomes impossible.
Published 20 Sept 2017 · NVD - Medium 6.1
CVE-2017-14615 · WatchGuard Fireware OS
An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Traffic Monitor" sections "Events" and "All." As…
Published 20 Sept 2017 · NVD - Critical 9.8
CVE-2017-14596 · Joomla!
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
Published 20 Sept 2017 · NVD - Low 3.7
CVE-2017-14595 · Joomla!
In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.
Published 20 Sept 2017 · NVD - Medium 6.1
CVE-2015-5608 · Joomla!
Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
Published 20 Sept 2017 · NVD - High 7.5
CVE-2015-3890 · OpenLiteSpeed
Use-after-free vulnerability in Open Litespeed before 1.3.10.
Published 20 Sept 2017 · Fixed in 1.3.10 · NVD - Medium 6.5
CVE-2015-2927 · Node.js
node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
Published 20 Sept 2017 · NVD - Medium 6.1
CVE-2014-9758 · Magento / Adobe Commerce
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
Published 20 Sept 2017 · NVD - High 7.5
CVE-2017-9804 · Apache Struts
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Published 20 Sept 2017 · NVD - High 7.5
CVE-2017-9793 · Apache Struts
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Published 20 Sept 2017 · NVD - High 8.1
CVE-2017-14607 · ImageMagick
In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
Published 20 Sept 2017 · NVD - Critical 9.8
CVE-2017-12611 · Apache Struts
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Published 20 Sept 2017 · NVD - Medium 5.9
CVE-2016-8738 · Apache Struts
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Published 20 Sept 2017 · NVD - Critical 9.8
CVE-2016-6795 · Apache Struts
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
Published 20 Sept 2017 · NVD - High 7.5
CVE-2017-14033 · Ruby
The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.
Published 19 Sept 2017 · NVD - High 8.8
CVE-2017-10784 · Ruby
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Published 19 Sept 2017 · NVD - Medium 6.1
CVE-2015-3880 · phpBB
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Published 19 Sept 2017 · NVD - Medium 5.9
CVE-2015-3420 · Dovecot
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
Published 19 Sept 2017 · NVD - Medium 6.5
CVE-2015-3419 · vBulletin
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure.
Published 19 Sept 2017 · NVD - High 7.5
CVE-2017-12616 · Apache Tomcat
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Published 19 Sept 2017 · NVD - High 8.1Actively exploited
CVE-2017-12615 · Apache Tomcat
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Published 19 Sept 2017 · NVD - High 7.5
CVE-2017-9803 · Apache Solr
Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super…
Published 18 Sept 2017 · NVD - Medium 5.9
CVE-2017-6147 · F5 BIG-IP
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles assigned to a BIG-IP Virtual Server.
Published 18 Sept 2017 · NVD - High 7.5
CVE-2017-9798 · Apache HTTP Server
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a…
Published 18 Sept 2017 · NVD - Medium 4.3
CVE-2017-12157 · Moodle
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
Published 18 Sept 2017 · NVD - Medium 6.1
CVE-2017-12156 · Moodle
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.
Published 18 Sept 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.