UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,355
Published in 7 days
268
Critical in 30 days
76
Actively exploited
66

Latest vulnerabilities

11,355 vulnerabilities
  1. High 7.8

    CVE-2016-1247 · nginx

    The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

    Published 29 Nov 2016 · NVD
  2. Unrated

    WPV-803a86c7f6a6 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 10 Nov 2016 · Fixed in 0.9.5 · WPVulnerability
  3. High 8.1

    CVE-2016-8870 · Joomla!

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

    Published 4 Nov 2016 · NVD
  4. Critical 9.8

    CVE-2016-8869 · Joomla!

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.

    Published 4 Nov 2016 · NVD
  5. Medium 6.5

    CVE-2016-9086 · GitLab

    GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was made available to all users.…

    Published 3 Nov 2016 · NVD
  6. Unrated

    WPV-3a86881f34e4 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 31 Oct 2016 · Fixed in 0.9.5 · WPVulnerability
  7. High 7.5

    CVE-2016-8867 · Docker Engine

    Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.

    Published 28 Oct 2016 · NVD
  8. Medium 4.4

    CVE-2016-8290 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-5633.

    Published 25 Oct 2016 · NVD
  9. Medium 4.7

    CVE-2016-8289 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  10. Low 3.1

    CVE-2016-8288 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin.

    Published 25 Oct 2016 · NVD
  11. Medium 4.5

    CVE-2016-8287 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication.

    Published 25 Oct 2016 · NVD
  12. Low 3.1

    CVE-2016-8286 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.

    Published 25 Oct 2016 · NVD
  13. Low 1.8

    CVE-2016-8284 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.

    Published 25 Oct 2016 · NVD
  14. Medium 4.3

    CVE-2016-8283 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.38 · NVD
  15. Medium 4.9

    CVE-2016-5635 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit.

    Published 25 Oct 2016 · NVD
  16. Medium 4.9

    CVE-2016-5634 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR.

    Published 25 Oct 2016 · NVD
  17. Medium 4.9

    CVE-2016-5633 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-8290.

    Published 25 Oct 2016 · NVD
  18. Medium 4.9

    CVE-2016-5632 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer.

    Published 25 Oct 2016 · NVD
  19. Medium 4.9

    CVE-2016-5631 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Memcached.

    Published 25 Oct 2016 · NVD
  20. Medium 4.9

    CVE-2016-5630 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · Fixed in 10.0.27 · NVD
  21. Medium 4.9

    CVE-2016-5629 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  22. Medium 4.9

    CVE-2016-5628 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: DML.

    Published 25 Oct 2016 · NVD
  23. Medium 6.5

    CVE-2016-5627 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  24. Medium 6.5

    CVE-2016-5626 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  25. High 7.0

    CVE-2016-5625 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Packaging.

    Published 25 Oct 2016 · NVD
  26. Medium 6.5

    CVE-2016-5624 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  27. Medium 6.5

    CVE-2016-5612 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 25 Oct 2016 · Fixed in 5.5.51, 10.0.27 · NVD
  28. Medium 6.5

    CVE-2016-5609 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 25 Oct 2016 · NVD
  29. Medium 5.9

    CVE-2016-5597 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking.

    Published 25 Oct 2016 · NVD
  30. Medium 4.4

    CVE-2016-5584 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier allows remote administrators to affect confidentiality via vectors related to Server: Security: Encryption.

    Published 25 Oct 2016 · Fixed in 5.5.53, 10.0.28, 10.1.19 · NVD
  31. Critical 9.6

    CVE-2016-5582 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573.

    Published 25 Oct 2016 · NVD
  32. High 8.3

    CVE-2016-5573 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5582.

    Published 25 Oct 2016 · NVD
  33. Critical 9.6

    CVE-2016-5568 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.

    Published 25 Oct 2016 · NVD
  34. Critical 9.6

    CVE-2016-5556 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.

    Published 25 Oct 2016 · NVD
  35. Medium 4.3

    CVE-2016-5554 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX.

    Published 25 Oct 2016 · NVD
  36. Low 3.1

    CVE-2016-5542 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries.

    Published 25 Oct 2016 · NVD
  37. Medium 4.9

    CVE-2016-5507 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.32 and earlier and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  38. Medium 4.9

    CVE-2016-3495 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  39. Medium 6.5

    CVE-2016-3492 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  40. Medium 5.9

    CVE-2016-7099 · Node.js

    The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

    Published 10 Oct 2016 · NVD
  41. Medium 6.1

    CVE-2016-5325 · Node.js

    CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

    Published 10 Oct 2016 · NVD
  42. Critical 9.8

    CVE-2016-7167 · curl

    Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

    Published 7 Oct 2016 · NVD
  43. High 7.5

    CVE-2016-7141 · curl

    curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

    Published 3 Oct 2016 · NVD
  44. Medium 5.5

    CVE-2016-6494 · MongoDB

    The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.

    Published 3 Oct 2016 · Fixed in 3.0.15, 3.2.14, 3.3.14 · NVD
  45. Critical 9.8

    CVE-2016-5180 · c-ares, Node.js

    Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

    Published 3 Oct 2016 · Fixed in 0.10.48, 0.12.17, 4.6.1 · NVD
  46. High 7.8

    CVE-2016-1240 · Apache Tomcat

    The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS…

    Published 3 Oct 2016 · NVD
  47. Critical 9.8

    CVE-2016-7568 · PHP

    Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

    Published 28 Sept 2016 · NVD
  48. Unrated

    WPV-d05a451389f7 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  49. Unrated

    WPV-c088b8f02483 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  50. Unrated

    WPV-bf344bf3a262 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.