Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,932
- Published in 7 days
- 1,035
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,932 vulnerabilities- High 7.8
CVE-2017-9611 · Ghostscript
The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
Published 26 Jul 2017 · NVD - Medium 6.1
CVE-2017-11612 · Joomla!
In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.
Published 26 Jul 2017 · NVD - Medium 6.5
CVE-2017-11644 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadMATImage() function in coders/mat.c.
Published 26 Jul 2017 · NVD - Medium 6.5
CVE-2017-11640 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in coders/tiff.c.
Published 26 Jul 2017 · NVD - Medium 6.5
CVE-2017-11639 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h.
Published 26 Jul 2017 · NVD - High 7.8
CVE-2017-11628 · PHP
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g.,…
Published 25 Jul 2017 · NVD - High 7.5
CVE-2017-9233 · Expat, Python
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
Published 25 Jul 2017 · Fixed in 3.4.7, 3.5.4, 3.6.2 · NVD - High 7.5
CVE-2016-7539 · ImageMagick
Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
Published 25 Jul 2017 · NVD - Critical 9.8
CVE-2015-8009 · MediaWiki
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.
Published 25 Jul 2017 · NVD - High 7.5
CVE-2017-11499 · Node.js
Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.
Published 25 Jul 2017 · NVD - High 7.1
CVE-2017-1382 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissions when custom startup scripts are used. A local attacker could exploit this to gain access to files with an unknown impact. IBM X-Force ID: 127153.
Published 24 Jul 2017 · NVD - Medium 5.4
CVE-2017-1380 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127151.
Published 24 Jul 2017 · NVD - High 8.8
CVE-2017-11422 · Statamic
Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc.
Published 24 Jul 2017 · Fixed in 2.6.0 · NVD - Medium 6.5
CVE-2017-11540 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the GetPixelIndex() function, called from the WritePICONImage function in coders/xpm.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11539 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadOnePNGImage() function in coders/png.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11538 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteOnePNGImage() function in coders/png.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11537 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an incorrect bits-per-pixel calculation.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11536 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteJP2Image() function in coders/jp2.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11535 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WritePSImage() function in coders/ps.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11534 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the lite_font_map() function in coders/wmf.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11533 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11532 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11531 · ImageMagick
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteHISTOGRAMImage() function in coders/histogram.c.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11530 · ImageMagick
The ReadEPTImage function in coders/ept.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11529 · ImageMagick
The ReadMATImage function in coders/mat.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11528 · ImageMagick
The ReadDIBImage function in coders/dib.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11527 · ImageMagick
The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11526 · ImageMagick
The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11525 · ImageMagick
The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11524 · ImageMagick
The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7.x before 7.6.0-0 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file.
Published 23 Jul 2017 · NVD - Medium 6.5
CVE-2017-11523 · ImageMagick
The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop) via a crafted file, because the end-of-file condition is not considered.
Published 22 Jul 2017 · NVD - Medium 6.5
CVE-2017-11522 · ImageMagick
The WriteOnePNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
Published 22 Jul 2017 · NVD - Low 3.3
CVE-2017-1381 · IBM WebSphere Application Server
IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152.
Published 21 Jul 2017 · NVD - Medium 6.5
CVE-2017-11505 · ImageMagick
The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a malformed JNG file.
Published 21 Jul 2017 · NVD - Medium 6.1
CVE-2017-11503 · PHPMailer
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.
Published 20 Jul 2017 · NVD - Medium 6.5
CVE-2017-11478 · ImageMagick
The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed DJVU image.
Published 20 Jul 2017 · NVD - High 8.8Actively exploited
CVE-2017-9822 · DNN Platform
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
Published 20 Jul 2017 · Fixed in 9.1.1 · NVD - High 8.8
CVE-2017-11475 · GLPI
GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.
Published 20 Jul 2017 · NVD - Critical 9.8
CVE-2017-11474 · GLPI
GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php.
Published 20 Jul 2017 · NVD - Critical 9.8
CVE-2017-11465 · Ruby
The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script, related to the parser_tokadd_utf8 function in parse.y. NOTE: this might have security relevance as a bypass of a $SAFE protection mechanism.
Published 19 Jul 2017 · NVD - Medium 5.4
CVE-2016-7509 · GLPI
Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket.
Published 19 Jul 2017 · NVD - High 8.0
CVE-2016-7507 · GLPI
Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application.
Published 19 Jul 2017 · NVD - High 8.8
CVE-2017-11450 · ImageMagick
coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short.
Published 19 Jul 2017 · Fixed in 6.9.9-0, 7.0.6-1 · NVD - High 8.8
CVE-2017-11449 · ImageMagick
coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin.
Published 19 Jul 2017 · Fixed in 6.9.9-0, 7.0.6-1 · NVD - Medium 6.5
CVE-2017-11448 · ImageMagick
The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.
Published 19 Jul 2017 · Fixed in 6.9.9-0, 7.0.6-1 · NVD - Medium 6.5
CVE-2017-11447 · ImageMagick
The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial of service.
Published 19 Jul 2017 · NVD - Medium 6.5
CVE-2017-11446 · ImageMagick
The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a crafted PES file.
Published 19 Jul 2017 · NVD - Medium 6.1
CVE-2017-9934 · Joomla!
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
Published 17 Jul 2017 · NVD - High 7.5
CVE-2017-9933 · Joomla!
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents.
Published 17 Jul 2017 · NVD - High 7.8
CVE-2017-11399 · FFmpeg
Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.
Published 17 Jul 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.