Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,932
- Published in 7 days
- 1,027
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,932 vulnerabilities- High 7.5
CVE-2016-6332 · MediaWiki
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.
Published 20 Apr 2017 · NVD - High 7.5
CVE-2016-6331 · MediaWiki
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
Published 20 Apr 2017 · NVD - High 7.5
CVE-2017-6919 · Drupal
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
Published 20 Apr 2017 · NVD - High 7.5
CVE-2017-7963 · PHP
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if…
Published 19 Apr 2017 · NVD - High 7.8
CVE-2017-7948 · Ghostscript
Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.
Published 19 Apr 2017 · NVD - Medium 6.5
CVE-2016-7537 · ImageMagick
MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.
Published 19 Apr 2017 · Fixed in 6.9.4-7 · NVD - Medium 6.5
CVE-2016-7533 · ImageMagick
The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file.
Published 19 Apr 2017 · Fixed in 6.9.4-0 · NVD - Medium 6.5
CVE-2016-7531 · ImageMagick
MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PDB file.
Published 19 Apr 2017 · Fixed in 7.0.1-0 · NVD - Medium 6.5
CVE-2016-7529 · ImageMagick
coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file.
Published 19 Apr 2017 · Fixed in 6.9.4-0 · NVD - Medium 6.5
CVE-2016-7528 · ImageMagick
The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.
Published 19 Apr 2017 · Fixed in 6.9.4-0 · NVD - Medium 6.5
CVE-2016-7522 · ImageMagick
The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Published 19 Apr 2017 · Fixed in 6.9.4-0 · NVD - Medium 6.5
CVE-2016-7519 · ImageMagick
The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
Published 19 Apr 2017 · Fixed in 6.9.4-0 · NVD - Medium 6.5
CVE-2016-7515 · ImageMagick
The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels.
Published 19 Apr 2017 · Fixed in 6.9.4-0 · NVD - Medium 6.5
CVE-2014-9907 · ImageMagick
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
Published 19 Apr 2017 · Fixed in 6.9.4-0 · NVD - Medium 6.5
CVE-2017-7943 · ImageMagick
The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
Published 18 Apr 2017 · NVD - Medium 6.5
CVE-2017-7942 · ImageMagick
The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
Published 18 Apr 2017 · NVD - Medium 6.5
CVE-2017-7941 · ImageMagick
The ReadSGIImage function in sgi.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
Published 18 Apr 2017 · NVD - Critical 9.8
CVE-2017-5645 · Apache Log4j, Oracle WebLogic Server
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Published 17 Apr 2017 · Fixed in 2.8.2 · NVD - High 7.5
CVE-2017-5659 · Apache Traffic Server
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.
Published 17 Apr 2017 · NVD - High 7.5
CVE-2016-5396 · Apache Traffic Server
Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
Published 17 Apr 2017 · NVD - Critical 9.8
CVE-2017-5651 · Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors…
Published 17 Apr 2017 · NVD - High 7.5
CVE-2017-5650 · Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that…
Published 17 Apr 2017 · NVD - Critical 9.1
CVE-2017-5648 · Apache Tomcat
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response…
Published 17 Apr 2017 · NVD - High 7.5
CVE-2017-5647 · Apache Tomcat
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent…
Published 17 Apr 2017 · NVD - High 7.8
CVE-2016-8602 · Ghostscript
The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
Published 14 Apr 2017 · NVD - High 7.5
CVE-2016-3104 · MongoDB
mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory database representation when authenticating against a non-existent database.
Published 14 Apr 2017 · NVD - High 7.8
CVE-2017-7218 · Palo Alto Networks PAN-OS
The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to gain privileges via unspecified request parameters.
Published 14 Apr 2017 · NVD - Medium 4.3
CVE-2017-7217 · Palo Alto Networks PAN-OS
The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allows remote attackers to write to export files via unspecified parameters.
Published 14 Apr 2017 · NVD - Critical 9.8
CVE-2017-7866 · FFmpeg
FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.
Published 14 Apr 2017 · NVD - Critical 9.8
CVE-2017-7865 · FFmpeg
FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.
Published 14 Apr 2017 · NVD - Critical 9.8
CVE-2017-7863 · FFmpeg
FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.
Published 14 Apr 2017 · NVD - Critical 9.8
CVE-2017-7862 · FFmpeg
FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.
Published 14 Apr 2017 · NVD - Critical 9.8
CVE-2017-7859 · FFmpeg
FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c.
Published 14 Apr 2017 · NVD - Medium 6.1
CVE-2017-7725 · Concrete CMS
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors,…
Published 13 Apr 2017 · NVD - Critical 9.8
CVE-2012-1301 · Umbraco CMS
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter.
Published 13 Apr 2017 · NVD - Critical 9.8
CVE-2016-4800 · Eclipse Jetty
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Published 13 Apr 2017 · NVD - Medium 6.1
CVE-2016-4068 · Roundcube
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
Published 13 Apr 2017 · NVD - Medium 6.1
CVE-2015-8864 · Roundcube
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
Published 13 Apr 2017 · NVD - Medium 6.5
CVE-2014-9837 · ImageMagick
coders/pnm.c in ImageMagick 6.9.0-1 Beta and earlier allows remote attackers to cause a denial of service (crash) via a crafted png file.
Published 11 Apr 2017 · NVD - Medium 6.2
CVE-2014-8716 · ImageMagick
The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash).
Published 11 Apr 2017 · NVD - Medium 5.5
CVE-2014-8562 · ImageMagick
DCM decode in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).
Published 11 Apr 2017 · NVD - Medium 5.5
CVE-2014-8355 · ImageMagick
PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).
Published 11 Apr 2017 · NVD - Medium 6.5
CVE-2014-8354 · ImageMagick
The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.
Published 11 Apr 2017 · NVD - Critical 9.8
CVE-2016-1908 · OpenSSH
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Published 11 Apr 2017 · Fixed in 7.2 · NVD - Medium 4.7
CVE-2017-5969 · libxml2
libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.
Published 11 Apr 2017 · NVD - High 7.5
CVE-2016-4483 · libxml2
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.
Published 11 Apr 2017 · Fixed in 2.9.4 · NVD - Medium 5.3
CVE-2016-7467 · F5 BIG-IP
The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector.
Published 11 Apr 2017 · NVD - Critical 9.8
CVE-2017-5983 · Jira
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
Published 10 Apr 2017 · NVD - Low 3.5
CVE-2017-5607 · Splunk Enterprise
Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.
Published 10 Apr 2017 · Fixed in 6.3.10, 6.4.6, 6.5.3 · NVD - High 7.5
CVE-2017-7619 · ImageMagick
In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv.
Published 10 Apr 2017 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.