UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,352
Published in 7 days
280
Critical in 30 days
76
Actively exploited
66

Latest vulnerabilities

11,352 vulnerabilities
  1. High 7.5

    CVE-2016-0768 · PostgreSQL

    PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.

    Published 6 Jun 2017 · NVD
  2. Medium 5.5

    CVE-2014-8180 · MongoDB

    MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.

    Published 6 Jun 2017 · NVD
  3. High 7.5

    CVE-2017-5664 · Apache Tomcat

    The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the…

    Published 6 Jun 2017 · NVD
  4. High 7.5

    CVE-2017-9229 · PHP, Ruby

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.

    Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD
  5. Critical 9.8

    CVE-2017-9228 · PHP

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical…

    Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD
  6. Critical 9.8

    CVE-2017-9227 · PHP

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.

    Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD
  7. Critical 9.8

    CVE-2017-9226 · PHP

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of…

    Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD
  8. Critical 9.8

    CVE-2017-9225 · PHP, Ruby

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the…

    Published 24 May 2017 · NVD
  9. Critical 9.8

    CVE-2017-9224 · PHP

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.

    Published 24 May 2017 · Fixed in 5.6.31, 7.0.21, 7.1.7 · NVD
  10. Critical 9.8

    CVE-2016-9843 · MariaDB, Node.js, Java and 1 more

    The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

    Published 23 May 2017 · Fixed in 10.1.37, 10.2.19, 10.3.11 · NVD
  11. High 8.8

    CVE-2016-9842 · Node.js, Java, MySQL

    The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

    Published 23 May 2017 · Fixed in 4.8.2, 6.10.2, 7.6.0 · NVD
  12. Critical 9.8

    CVE-2016-9841 · Node.js, Java, MySQL

    inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

    Published 23 May 2017 · Fixed in 4.8.2, 6.10.2, 7.6.0 · NVD
  13. High 8.8

    CVE-2016-9840 · Node.js, Java, MySQL

    inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

    Published 23 May 2017 · Fixed in 4.8.2, 6.10.2, 7.6.0 · NVD
  14. Critical 9.8

    CVE-2017-9119 · PHP

    The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures.

    Published 21 May 2017 · NVD
  15. High 7.0

    CVE-2017-9067 · PHP

    In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

    Published 18 May 2017 · NVD
  16. High 8.6

    CVE-2017-9066 · WordPress

    In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.

    Published 18 May 2017 · NVD
  17. High 7.5

    CVE-2017-9065 · WordPress

    In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.

    Published 18 May 2017 · NVD
  18. High 8.8

    CVE-2017-9064 · WordPress

    In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.

    Published 18 May 2017 · NVD
  19. Medium 6.1

    CVE-2017-9063 · WordPress

    In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.

    Published 18 May 2017 · NVD
  20. High 8.6

    CVE-2017-9062 · WordPress

    In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.

    Published 18 May 2017 · NVD
  21. Medium 6.1

    CVE-2017-9061 · WordPress

    In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.

    Published 18 May 2017 · NVD
  22. Critical 9.8

    CVE-2017-8917 · Joomla!

    SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

    Published 17 May 2017 · NVD
  23. Critical 9.8

    CVE-2017-8923 · PHP

    The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

    Published 12 May 2017 · Fixed in 7.4.24, 8.0.11 · NVD
  24. High 7.5

    CVE-2017-7486 · PostgreSQL

    PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

    Published 12 May 2017 · NVD
  25. Medium 5.9

    CVE-2017-7485 · PostgreSQL

    In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.

    Published 12 May 2017 · NVD
  26. High 7.5

    CVE-2017-7484 · PostgreSQL

    It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to…

    Published 12 May 2017 · NVD
  27. Unrated

    WPV-02c6e05dce9d · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 11 May 2017 · Fixed in 3.3.2 · WPVulnerability
  28. Low 3.5

    CVE-2017-0895 · Nextcloud

    Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.

    Published 8 May 2017 · Fixed in 10.0.4, 11.0.2 · NVD
  29. Medium 4.3

    CVE-2017-0894 · Nextcloud

    Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.

    Published 8 May 2017 · Fixed in 11.0.3 · NVD
  30. Medium 5.4

    CVE-2017-0893 · Nextcloud

    Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.

    Published 8 May 2017 · Fixed in 9.0.58, 10.0.5, 11.0.3 · NVD
  31. Low 3.5

    CVE-2017-0892 · Nextcloud

    Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.

    Published 8 May 2017 · Fixed in 11.0.3 · NVD
  32. Medium 5.4

    CVE-2017-0891 · Nextcloud

    Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.

    Published 8 May 2017 · Fixed in 9.0.58, 10.0.5, 11.0.3 · NVD
  33. Medium 5.4

    CVE-2017-0890 · Nextcloud

    Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

    Published 8 May 2017 · Fixed in 11.0.3 · NVD
  34. Medium 5.9

    CVE-2016-7055 · Node.js, OpenSSL

    There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input…

    Published 4 May 2017 · Fixed in 4.7.3, 6.9.5, 7.5.0 · NVD
  35. High 7.5

    CVE-2017-3733 · OpenSSL

    During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.

    Published 4 May 2017 · NVD
  36. Medium 5.9

    CVE-2017-3732 · Node.js, OpenSSL

    There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of…

    Published 4 May 2017 · Fixed in 4.7.3, 6.9.5, 7.5.0 · NVD
  37. High 7.5

    CVE-2017-3731 · Node.js, OpenSSL

    If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users…

    Published 4 May 2017 · Fixed in 4.7.3, 6.9.5, 7.5.0 · NVD
  38. High 7.5

    CVE-2017-3730 · OpenSSL

    In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.

    Published 4 May 2017 · NVD
  39. High 7.5

    CVE-2016-7054 · OpenSSL

    In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.

    Published 4 May 2017 · NVD
  40. High 7.5

    CVE-2016-7053 · OpenSSL

    In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL…

    Published 4 May 2017 · NVD
  41. Medium 6.1

    CVE-2017-8778 · GitLab

    GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.

    Published 4 May 2017 · NVD
  42. Medium 5.9

    CVE-2017-8295 · WordPress

    WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to…

    Published 4 May 2017 · NVD
  43. High 7.5

    CVE-2017-7415 · Confluence

    Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource.

    Published 27 Apr 2017 · NVD
  44. Unrated

    WPV-6044e31f3104 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 26 Apr 2017 · Fixed in 4.2 · WPVulnerability
  45. Unrated

    WPV-507bc9daff8a · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 26 Apr 2017 · Fixed in 4.2 · WPVulnerability
  46. Unrated

    WPV-2d2e06eb178d · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 26 Apr 2017 · Fixed in 4.2 · WPVulnerability
  47. Medium 6.1

    CVE-2016-10706 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 26 Apr 2017 · Fixed in 4.0.3 · NVD, WPVulnerability
  48. Medium 5.3

    CVE-2017-8057 · Joomla!

    In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting.

    Published 25 Apr 2017 · NVD
  49. Medium 6.5

    CVE-2017-7989 · Joomla!

    In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden.

    Published 25 Apr 2017 · NVD
  50. Medium 5.3

    CVE-2017-7988 · Joomla!

    In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article.

    Published 25 Apr 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.