UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,355
Published in 7 days
257
Critical in 30 days
76
Actively exploited
66

Latest vulnerabilities

11,355 vulnerabilities
  1. Unrated

    WPV-4cd16c8377a3 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  2. High 7.5

    CVE-2016-7052 · Node.js, OpenSSL

    crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.

    Published 26 Sept 2016 · Fixed in 4.6.0, 6.7.0 · NVD
  3. Critical 9.8

    CVE-2016-6309 · OpenSSL

    statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.

    Published 26 Sept 2016 · NVD
  4. Medium 5.9

    CVE-2016-6308 · OpenSSL

    statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted DTLS messages.

    Published 26 Sept 2016 · NVD
  5. Medium 5.9

    CVE-2016-6307 · OpenSSL

    The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted TLS messages, related to statem/statem.c and statem/statem_lib.c.

    Published 26 Sept 2016 · NVD
  6. Medium 5.9

    CVE-2016-6306 · Node.js, OpenSSL

    The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

    Published 26 Sept 2016 · Fixed in 0.12.16, 4.6.0, 6.7.0 · NVD
  7. High 7.5

    CVE-2016-6305 · OpenSSL

    The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.

    Published 26 Sept 2016 · NVD
  8. High 7.5

    CVE-2016-6304 · Node.js, OpenSSL

    Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

    Published 26 Sept 2016 · Fixed in 0.12.16, 4.6.0, 6.7.0 · NVD
  9. Unrated

    WPV-adb039f25864 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  10. Unrated

    WPV-8fde612f0730 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  11. Unrated

    WPV-4eb9434d7a35 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  12. Unrated

    WPV-4b1b785cdfa0 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  13. Unrated

    WPV-2ee9c58fe403 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  14. Medium 6.5

    CVE-2016-5172 · Node.js

    The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.

    Published 25 Sept 2016 · NVD
  15. Critical 9.8

    CVE-2016-6662 · MariaDB, MySQL

    Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE:…

    Published 20 Sept 2016 · Fixed in 5.5.51, 10.0.27, 10.1.17 · NVD
  16. Medium 5.4

    CVE-2016-7419 · Nextcloud

    Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

    Published 17 Sept 2016 · NVD
  17. High 7.5

    CVE-2016-7418 · PHP

    The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.

    Published 17 Sept 2016 · NVD
  18. Critical 9.8

    CVE-2016-7417 · PHP

    ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.

    Published 17 Sept 2016 · NVD
  19. High 7.5

    CVE-2016-7416 · PHP

    ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.

    Published 17 Sept 2016 · NVD
  20. Critical 9.8

    CVE-2016-7414 · PHP

    The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.

    Published 17 Sept 2016 · NVD
  21. Critical 9.8

    CVE-2016-7413 · PHP

    Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.

    Published 17 Sept 2016 · NVD
  22. High 8.1

    CVE-2016-7412 · PHP

    ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted field metadata.

    Published 17 Sept 2016 · NVD
  23. Critical 9.8

    CVE-2016-7411 · PHP

    ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.

    Published 17 Sept 2016 · NVD
  24. Critical 9.8

    CVE-2016-6303 · Node.js, OpenSSL

    Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

    Published 16 Sept 2016 · Fixed in 0.12.16, 4.6.0, 6.6.0 · NVD
  25. High 7.5

    CVE-2016-6302 · OpenSSL

    The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.

    Published 16 Sept 2016 · NVD
  26. Critical 9.8

    CVE-2016-2182 · OpenSSL

    The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

    Published 16 Sept 2016 · NVD
  27. High 7.5

    CVE-2016-2181 · OpenSSL

    The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

    Published 16 Sept 2016 · NVD
  28. High 7.5

    CVE-2016-2179 · OpenSSL

    The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.

    Published 16 Sept 2016 · NVD
  29. Critical 9.8

    CVE-2016-7134 · PHP

    ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and heap-based buffer overflow) or possibly have unspecified other impact via a long string that is mishandled in a curl_escape call.

    Published 12 Sept 2016 · NVD
  30. High 8.1

    CVE-2016-7133 · PHP

    Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.

    Published 12 Sept 2016 · NVD
  31. High 7.5

    CVE-2016-7132 · PHP

    ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.

    Published 12 Sept 2016 · NVD
  32. High 7.5

    CVE-2016-7131 · PHP

    ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.

    Published 12 Sept 2016 · NVD
  33. High 7.5

    CVE-2016-7130 · PHP

    The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.

    Published 12 Sept 2016 · NVD
  34. Critical 9.8

    CVE-2016-7129 · PHP

    The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.

    Published 12 Sept 2016 · NVD
  35. Medium 5.3

    CVE-2016-7128 · PHP

    The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.

    Published 12 Sept 2016 · NVD
  36. Critical 9.8

    CVE-2016-7127 · PHP

    The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.

    Published 12 Sept 2016 · NVD
  37. Critical 9.8

    CVE-2016-7126 · PHP

    The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.

    Published 12 Sept 2016 · NVD
  38. High 7.5

    CVE-2016-7125 · PHP

    ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.

    Published 12 Sept 2016 · NVD
  39. Critical 9.8

    CVE-2016-7124 · PHP

    ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.

    Published 12 Sept 2016 · NVD
  40. Unrated

    WPV-833cfe6a8cde · WooCommerce

    Vulnerability in WooCommerce

    Published 9 Sept 2016 · Fixed in 2.6.4 · WPVulnerability
  41. Medium 6.1

    CVE-2016-5699 · Python

    CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

    Published 2 Sept 2016 · NVD
  42. Critical 9.8

    CVE-2016-5636 · Python

    Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

    Published 2 Sept 2016 · NVD
  43. Medium 6.5

    CVE-2016-0772 · Python

    The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

    Published 2 Sept 2016 · NVD
  44. High 7.5

    CVE-2016-2183 · Node.js, OpenSSL, Python

    The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

    Published 1 Sept 2016 · Fixed in 4.1.2, 4.6.0, 6.7.0 · NVD
  45. Medium 6.5

    CVE-2016-6207 · PHP

    Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.

    Published 12 Aug 2016 · Fixed in 5.5.38, 5.6.24, 7.0.9 · NVD
  46. High 8.1

    CVE-2016-5421 · curl

    Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.

    Published 10 Aug 2016 · NVD
  47. High 7.5

    CVE-2016-5420 · curl

    curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

    Published 10 Aug 2016 · NVD
  48. High 7.5

    CVE-2016-5419 · curl

    curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

    Published 10 Aug 2016 · NVD
  49. Unrated

    WPV-20dff45ce4cc · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 8 Aug 2016 · Fixed in 1.1.13 · WPVulnerability
  50. High 7.5

    CVE-2016-6515 · OpenSSH

    The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

    Published 7 Aug 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.