Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,932
- Published in 7 days
- 1,035
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,932 vulnerabilities- Medium 4.8
CVE-2017-12572 · Splunk Enterprise
Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.
Published 5 Aug 2017 · NVD - Medium 6.5
CVE-2017-12566 · ImageMagick
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c, which allows attackers to cause a denial of service, related to the function ReadSVGImage in svg.c.
Published 5 Aug 2017 · NVD - Medium 6.5
CVE-2017-12565 · ImageMagick
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.
Published 5 Aug 2017 · NVD - Medium 6.5
CVE-2017-12564 · ImageMagick
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.
Published 5 Aug 2017 · NVD - Medium 6.5
CVE-2017-12563 · ImageMagick
In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of service.
Published 5 Aug 2017 · NVD - High 7.5
CVE-2017-12435 · ImageMagick
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service.
Published 4 Aug 2017 · NVD - Medium 6.5
CVE-2017-12434 · ImageMagick
In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.
Published 4 Aug 2017 · NVD - Medium 6.5
CVE-2017-12433 · ImageMagick
In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadPESImage in coders/pes.c, which allows attackers to cause a denial of service, related to ResizeMagickMemory in memory.c.
Published 4 Aug 2017 · NVD - Medium 6.5
CVE-2017-12432 · ImageMagick
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of service.
Published 4 Aug 2017 · NVD - Medium 6.5
CVE-2017-12431 · ImageMagick
In ImageMagick 7.0.6-1, a use-after-free vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service.
Published 4 Aug 2017 · NVD - High 7.5
CVE-2017-12430 · ImageMagick
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service.
Published 4 Aug 2017 · NVD - High 7.5
CVE-2017-12429 · ImageMagick
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.
Published 4 Aug 2017 · NVD - High 7.5
CVE-2017-12428 · ImageMagick
In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.
Published 4 Aug 2017 · NVD - Medium 6.5
CVE-2017-12427 · ImageMagick
The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.
Published 4 Aug 2017 · NVD - High 7.5
CVE-2017-12425 · Varnish Cache
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker…
Published 4 Aug 2017 · NVD - High 7.5
CVE-2017-12418 · ImageMagick
ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c.
Published 4 Aug 2017 · NVD - Medium 6.5
CVE-2017-1504 · IBM WebSphere Application Server
IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryption. IBM X-Force ID: 129579.
Published 3 Aug 2017 · NVD - Medium 6.1
CVE-2017-9467 · Palo Alto Networks PAN-OS
Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 2 Aug 2017 · NVD - Medium 6.1
CVE-2017-9459 · Palo Alto Networks PAN-OS
Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 2 Aug 2017 · NVD - Critical 9.8
CVE-2017-8390 · Palo Alto Networks PAN-OS
The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name.
Published 2 Aug 2017 · NVD - Medium 6.5
CVE-2017-7890 · PHP
The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.
Published 2 Aug 2017 · NVD - Medium 6.3
CVE-2017-11438 · GitLab
GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.
Published 2 Aug 2017 · NVD - Medium 6.5
CVE-2017-11437 · GitLab
GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.
Published 2 Aug 2017 · NVD - High 8.8
CVE-2017-11364 · Joomla!
The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.
Published 2 Aug 2017 · NVD - Medium 6.5
CVE-2017-12140 · ImageMagick
The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file.
Published 2 Aug 2017 · NVD - Critical 9.8
CVE-2017-4923 · VMware vCenter Server
VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.
Published 1 Aug 2017 · NVD - Medium 6.5
CVE-2017-4922 · VMware vCenter Server
VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical information when the service gets restarted.
Published 1 Aug 2017 · NVD - High 8.8
CVE-2017-4921 · VMware vCenter Server
VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation.
Published 1 Aug 2017 · NVD - Medium 5.9
CVE-2017-12132 · GNU C Library
The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.
Published 1 Aug 2017 · NVD - Medium 6.5
CVE-2017-11755 · ImageMagick
The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an AcquireSemaphoreInfo call.
Published 30 Jul 2017 · NVD - Medium 6.5
CVE-2017-11754 · ImageMagick
The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an OpenPixelCache call.
Published 30 Jul 2017 · NVD - Medium 6.5
CVE-2017-11753 · ImageMagick
The GetImageDepth function in MagickCore/attribute.c in ImageMagick 7.0.6-4 might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted Flexible Image Transport System (FITS) file.
Published 30 Jul 2017 · NVD - Medium 6.5
CVE-2017-11752 · ImageMagick
The ReadMAGICKImage function in coders/magick.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Jul 2017 · NVD - Medium 6.5
CVE-2017-11751 · ImageMagick
The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Jul 2017 · NVD - Medium 6.5
CVE-2017-11750 · ImageMagick
The ReadOneJNGImage function in coders/png.c in ImageMagick 6.9.9-4 and 7.0.6-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
Published 30 Jul 2017 · NVD - High 7.8
CVE-2017-11742 · Expat
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.
Published 30 Jul 2017 · NVD - Medium 6.5
CVE-2017-11724 · ImageMagick
The ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x through 7.0.6-3 has memory leaks involving the quantum_info and clone_info data structures.
Published 29 Jul 2017 · NVD - Critical 9.0
CVE-2017-4919 · VMware vCenter Server
VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.
Published 28 Jul 2017 · NVD - High 7.8
CVE-2017-11719 · FFmpeg
The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.
Published 28 Jul 2017 · NVD - High 7.8
CVE-2017-11714 · Ghostscript
psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.
Published 28 Jul 2017 · NVD - Critical 9.8
CVE-2017-11184 · GLPI
SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.
Published 28 Jul 2017 · NVD - Medium 4.9
CVE-2017-11183 · GLPI
front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter.
Published 28 Jul 2017 · NVD - Unrated
WPV-3ad5db4857fe · WP Rocket (WordPress plugin)
Vulnerability in WP Rocket
Published 28 Jul 2017 · Fixed in 2.10.4 · WPVulnerability - High 7.5
CVE-2016-8743 · Apache HTTP Server
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result…
Published 27 Jul 2017 · NVD - High 7.5
CVE-2016-2161 · Apache HTTP Server
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
Published 27 Jul 2017 · NVD - High 7.5
CVE-2016-0736 · Apache HTTP Server
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
Published 27 Jul 2017 · NVD - High 7.5
CVE-2017-11665 · FFmpeg
The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash) via a crafted stream.
Published 27 Jul 2017 · NVD - High 7.5
CVE-2017-7659 · Apache HTTP Server
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.
Published 26 Jul 2017 · NVD - High 8.1
CVE-2017-11667 · OpenProject
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
Published 26 Jul 2017 · NVD - High 7.8
CVE-2017-9835 · Ghostscript
The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
Published 26 Jul 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.