Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,932
- Published in 7 days
- 1,029
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,932 vulnerabilities- Critical 9.8
CVE-2017-7886 · Dolibarr ERP CRM
Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.
Published 10 May 2017 · NVD - High 8.1
CVE-2017-1137 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to the admin console. IBM X-Force ID: 121549.
Published 10 May 2017 · NVD - High 7.5
CVE-2016-9250 · F5 BIG-IP
In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism.
Published 10 May 2017 · NVD - High 8.8
CVE-2017-8874 · Mautic
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete contacts.
Published 10 May 2017 · NVD - Critical 9.1
CVE-2017-8872 · libxml2
The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.
Published 10 May 2017 · NVD - Medium 5.9
CVE-2017-6137 · F5 BIG-IP
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on specific platforms and configurations.
Published 9 May 2017 · NVD - Medium 5.3
CVE-2017-0302 · F5 BIG-IP
In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters.
Published 9 May 2017 · NVD - Medium 6.1
CVE-2016-9257 · F5 BIG-IP
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.
Published 9 May 2017 · NVD - High 7.5
CVE-2016-9256 · F5 BIG-IP
In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the…
Published 9 May 2017 · NVD - High 7.5
CVE-2016-9253 · F5 BIG-IP
In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.
Published 9 May 2017 · NVD - High 8.8
CVE-2016-9251 · F5 BIG-IP
In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection.
Published 9 May 2017 · NVD - Low 3.5
CVE-2017-0895 · Nextcloud
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
Published 8 May 2017 · Fixed in 10.0.4, 11.0.2 · NVD - Medium 4.3
CVE-2017-0894 · Nextcloud
Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.
Published 8 May 2017 · Fixed in 11.0.3 · NVD - Medium 5.4
CVE-2017-0893 · Nextcloud
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.
Published 8 May 2017 · Fixed in 9.0.58, 10.0.5, 11.0.3 · NVD - Low 3.5
CVE-2017-0892 · Nextcloud
Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.
Published 8 May 2017 · Fixed in 11.0.3 · NVD - Medium 5.4
CVE-2017-0891 · Nextcloud
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.
Published 8 May 2017 · Fixed in 9.0.58, 10.0.5, 11.0.3 · NVD - Medium 5.4
CVE-2017-0890 · Nextcloud
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.
Published 8 May 2017 · Fixed in 11.0.3 · NVD - Medium 6.5
CVE-2017-8830 · ImageMagick
In ImageMagick 7.0.5-6, the ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 8 May 2017 · NVD - High 7.5
CVE-2017-8804 · GNU C Library
The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and…
Published 7 May 2017 · NVD - Medium 5.9
CVE-2016-7055 · Node.js, OpenSSL
There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input…
Published 4 May 2017 · Fixed in 4.7.3, 6.9.5, 7.5.0 · NVD - High 7.5
CVE-2017-3733 · OpenSSL
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.
Published 4 May 2017 · NVD - Medium 5.9
CVE-2017-3732 · Node.js, OpenSSL
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of…
Published 4 May 2017 · Fixed in 4.7.3, 6.9.5, 7.5.0 · NVD - High 7.5
CVE-2017-3731 · Node.js, OpenSSL
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users…
Published 4 May 2017 · Fixed in 4.7.3, 6.9.5, 7.5.0 · NVD - High 7.5
CVE-2017-3730 · OpenSSL
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
Published 4 May 2017 · NVD - High 7.5
CVE-2016-7054 · OpenSSL
In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.
Published 4 May 2017 · NVD - High 7.5
CVE-2016-7053 · OpenSSL
In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL…
Published 4 May 2017 · NVD - Medium 6.1
CVE-2017-8778 · GitLab
GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.
Published 4 May 2017 · NVD - Medium 5.9
CVE-2017-8295 · WordPress
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to…
Published 4 May 2017 · NVD - Medium 6.5
CVE-2017-8765 · ImageMagick
The function named ReadICONImage in coders\icon.c in ImageMagick 7.0.5-5 has a memory leak vulnerability which can cause memory exhaustion via a crafted ICON file.
Published 4 May 2017 · NVD - Low 3.8
CVE-2017-7995 · Xen
Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.
Published 3 May 2017 · NVD - Medium 6.5
CVE-2017-7216 · Palo Alto Networks PAN-OS
The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified request parameters.
Published 2 May 2017 · NVD - High 7.5
CVE-2017-6128 · F5 BIG-IP
An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow.
Published 1 May 2017 · NVD - Medium 5.3
CVE-2017-8385 · Craft CMS
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
Published 1 May 2017 · NVD - Medium 6.1
CVE-2017-8384 · Craft CMS
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
Published 1 May 2017 · NVD - Medium 5.3
CVE-2017-8383 · Craft CMS
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
Published 1 May 2017 · NVD - Medium 6.5
CVE-2017-8357 · ImageMagick
In ImageMagick 7.0.5-5, the ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8356 · ImageMagick
In ImageMagick 7.0.5-5, the ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8355 · ImageMagick
In ImageMagick 7.0.5-5, the ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8354 · ImageMagick
In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8353 · ImageMagick
In ImageMagick 7.0.5-5, the ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8352 · ImageMagick
In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8351 · ImageMagick
In ImageMagick 7.0.5-5, the ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8350 · ImageMagick
In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8349 · ImageMagick
In ImageMagick 7.0.5-5, the ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8348 · ImageMagick
In ImageMagick 7.0.5-5, the ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8347 · ImageMagick
In ImageMagick 7.0.5-5, the ReadEXRImage function in exr.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8346 · ImageMagick
In ImageMagick 7.0.5-5, the ReadDCMImage function in dcm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8345 · ImageMagick
In ImageMagick 7.0.5-5, the ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8344 · ImageMagick
In ImageMagick 7.0.5-5, the ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD - Medium 6.5
CVE-2017-8343 · ImageMagick
In ImageMagick 7.0.5-5, the ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Published 30 Apr 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.