Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,932
- Published in 7 days
- 1,029
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,932 vulnerabilities- Medium 4.9
CVE-2014-6031 · F5 BIG-IP
Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, 11.5.x before 11.5.2 HF1, and 11.6.0 before HF4, and Enterprise Manager 2.1.0 through 2.3.0 and 3.x before 3.1.1 HF5 allows remote authenticated administrators to cause a denial of service via unspecified vectors.
Published 8 Jun 2017 · NVD - Medium 5.4
CVE-2017-9516 · Craft CMS
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
Published 8 Jun 2017 · NVD - Medium 5.5
CVE-2017-4905 · VMware ESXi
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak.
Published 7 Jun 2017 · NVD - High 8.8
CVE-2017-4904 · VMware ESXi
The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 has uninitialized memory usage. This issue may allow a guest…
Published 7 Jun 2017 · NVD - High 8.8
CVE-2017-4903 · VMware ESXi
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have an uninitialized stack memory usage in SVGA. This issue may allow a guest to…
Published 7 Jun 2017 · NVD - High 8.8
CVE-2017-4902 · VMware ESXi
VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host.
Published 7 Jun 2017 · NVD - Medium 6.5
CVE-2017-9501 · ImageMagick
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted file.
Published 7 Jun 2017 · NVD - Medium 6.5
CVE-2017-9500 · ImageMagick
In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a denial of service via a crafted file.
Published 7 Jun 2017 · NVD - Medium 6.5
CVE-2017-9499 · ImageMagick
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.
Published 7 Jun 2017 · NVD - Medium 6.5
CVE-2017-9461 · Samba
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
Published 6 Jun 2017 · NVD - High 7.5
CVE-2016-0768 · PostgreSQL
PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.
Published 6 Jun 2017 · NVD - Medium 5.5
CVE-2014-8180 · MongoDB
MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.
Published 6 Jun 2017 · NVD - High 7.5
CVE-2017-5664 · Apache Tomcat
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the…
Published 6 Jun 2017 · NVD - Medium 6.5
CVE-2017-9440 · ImageMagick
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.
Published 5 Jun 2017 · NVD - Medium 6.5
CVE-2017-9439 · ImageMagick
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.
Published 5 Jun 2017 · NVD - High 8.2
CVE-2017-1000368 · sudo
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
Published 5 Jun 2017 · NVD - Critical 9.8
CVE-2017-9435 · Dolibarr ERP CRM
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
Published 5 Jun 2017 · NVD - Medium 6.1
CVE-2017-8440 · Kibana
Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Published 5 Jun 2017 · NVD - Medium 6.1
CVE-2017-8439 · Kibana
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
Published 5 Jun 2017 · NVD - Medium 6.4
CVE-2017-1000367 · sudo
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Published 5 Jun 2017 · NVD - Medium 6.5
CVE-2017-9416 · Odoo
Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.
Published 4 Jun 2017 · NVD - Medium 6.5
CVE-2017-9409 · ImageMagick
In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 2 Jun 2017 · NVD - Medium 6.5
CVE-2017-9407 · ImageMagick
In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 2 Jun 2017 · NVD - Medium 6.5
CVE-2017-9405 · ImageMagick
In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 2 Jun 2017 · NVD - High 7.8
CVE-2015-6531 · Palo Alto Networks PAN-OS
Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image file.
Published 1 Jun 2017 · NVD - Medium 6.1
CVE-2017-3127 · Fortinet FortiOS
A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation.
Published 1 Jun 2017 · NVD - Critical 9.8Actively exploited
CVE-2017-7494 · Samba
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
Published 30 May 2017 · Fixed in 4.4.14, 4.5.10, 4.6.4 · NVD - Medium 6.5
CVE-2017-9262 · ImageMagick
In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 29 May 2017 · NVD - Medium 6.5
CVE-2017-9261 · ImageMagick
In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 29 May 2017 · NVD - Medium 6.1
CVE-2017-3129 · Fortinet FortiWeb
A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature.
Published 27 May 2017 · NVD - High 7.8Actively exploited
CVE-2017-8540 · Microsoft Exchange Server
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory…
Published 26 May 2017 · NVD - Medium 5.5
CVE-2017-8537 · Microsoft Exchange Server
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of…
Published 26 May 2017 · NVD - Medium 5.5
CVE-2017-8536 · Microsoft Exchange Server
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of…
Published 26 May 2017 · NVD - Medium 5.5
CVE-2017-8535 · Microsoft Exchange Server
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of…
Published 26 May 2017 · NVD - High 7.5
CVE-2017-9229 · PHP, Ruby
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.
Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD - Critical 9.8
CVE-2017-9228 · PHP
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical…
Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD - Critical 9.8
CVE-2017-9227 · PHP
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD - Critical 9.8
CVE-2017-9226 · PHP
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of…
Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD - Critical 9.8
CVE-2017-9225 · PHP, Ruby
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the…
Published 24 May 2017 · NVD - Critical 9.8
CVE-2017-9224 · PHP
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD - High 8.1
CVE-2017-2824 · Zabbix
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.
Published 24 May 2017 · NVD - Medium 4.8
CVE-2017-3128 · Fortinet FortiOS
A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label parameter.
Published 23 May 2017 · NVD - Critical 9.8
CVE-2017-6131 · F5 BIG-IP
In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment. The root and admin accounts are not vulnerable. An attacker may be able to remotely…
Published 23 May 2017 · NVD - Medium 6.1
CVE-2017-7288 · Zimbra Collaboration
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 23 May 2017 · NVD - Critical 9.8
CVE-2017-6821 · Zimbra Collaboration
Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors.
Published 23 May 2017 · NVD - Critical 9.8
CVE-2017-6813 · Zimbra Collaboration
A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested operations.
Published 23 May 2017 · NVD - Critical 9.8
CVE-2016-9843 · MariaDB, Node.js, Java and 1 more
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
Published 23 May 2017 · Fixed in 10.1.37, 10.2.19, 10.3.11 · NVD - High 8.8
CVE-2016-9842 · Node.js, Java, MySQL
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
Published 23 May 2017 · Fixed in 4.8.2, 6.10.2, 7.6.0 · NVD - Critical 9.8
CVE-2016-9841 · Node.js, Java, MySQL
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Published 23 May 2017 · Fixed in 4.8.2, 6.10.2, 7.6.0 · NVD - High 8.8
CVE-2016-9840 · Node.js, Java, MySQL
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Published 23 May 2017 · Fixed in 4.8.2, 6.10.2, 7.6.0 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.