UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,355
Published in 7 days
256
Critical in 30 days
76
Actively exploited
66

Latest vulnerabilities

11,355 vulnerabilities
  1. High 8.8

    CVE-2016-6635 · WordPress

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

    Published 7 Aug 2016 · NVD
  2. Medium 6.1

    CVE-2016-6634 · WordPress

    Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 7 Aug 2016 · NVD
  3. High 8.6

    CVE-2016-4029 · WordPress

    WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

    Published 7 Aug 2016 · Fixed in 4.5 · NVD
  4. Critical 9.8

    CVE-2016-5773 · PHP

    php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.

    Published 7 Aug 2016 · NVD
  5. Critical 9.8

    CVE-2016-5772 · PHP

    Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.

    Published 7 Aug 2016 · Fixed in 5.5.37, 5.6.23, 7.0.8 · NVD
  6. Critical 9.8

    CVE-2016-5771 · PHP

    spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.

    Published 7 Aug 2016 · Fixed in 5.5.37, 5.6.23, 7.0.8 · NVD
  7. Critical 9.8

    CVE-2016-5770 · PHP

    Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.

    Published 7 Aug 2016 · Fixed in 5.5.37, 5.6.23, 7.0.8 · NVD
  8. Critical 9.8

    CVE-2016-5769 · PHP

    Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.

    Published 7 Aug 2016 · NVD
  9. Critical 9.8

    CVE-2016-5768 · PHP

    Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.

    Published 7 Aug 2016 · NVD
  10. Critical 9.1

    CVE-2016-5114 · PHP

    sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.

    Published 7 Aug 2016 · NVD
  11. High 8.6

    CVE-2016-5096 · PHP

    Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.

    Published 7 Aug 2016 · NVD
  12. High 8.6

    CVE-2016-5095 · PHP

    Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-5094.

    Published 7 Aug 2016 · NVD
  13. High 8.6

    CVE-2016-5094 · PHP

    Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.

    Published 7 Aug 2016 · NVD
  14. High 8.6

    CVE-2016-5093 · PHP

    The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.

    Published 7 Aug 2016 · NVD
  15. Critical 9.8

    CVE-2016-3132 · PHP

    Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

    Published 7 Aug 2016 · NVD
  16. Critical 9.8

    CVE-2016-3078 · PHP

    Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.

    Published 7 Aug 2016 · Fixed in 7.0.6 · NVD
  17. Medium 6.1

    CVE-2015-8935 · PHP

    The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.

    Published 7 Aug 2016 · NVD
  18. Unrated

    WPV-4edde3b81b8f · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 3 Aug 2016 · Fixed in 3.4.1 · WPVulnerability
  19. Medium 5.4

    CVE-2021-24153 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 2 Aug 2016 · Fixed in 3.4.1 · NVD, WPVulnerability
  20. High 7.5

    CVE-2016-2180 · OpenSSL

    The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.

    Published 1 Aug 2016 · NVD
  21. Unrated

    WPV-37b52e38ea4b · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 29 Jul 2016 · Fixed in 0.9.5 · WPVulnerability
  22. Unrated

    WPV-517508d538ba · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 28 Jul 2016 · Fixed in 1.4.5 · WPVulnerability
  23. Unrated

    WPV-3301354740c7 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 28 Jul 2016 · Fixed in 1.4.7 · WPVulnerability
  24. Unrated

    WPV-15ae7f0fa756 · WooCommerce

    Vulnerability in WooCommerce

    Published 26 Jul 2016 · Fixed in 2.6.4 · WPVulnerability
  25. High 8.8

    CVE-2016-6297 · PHP

    Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.

    Published 25 Jul 2016 · NVD
  26. Critical 9.8

    CVE-2016-6296 · PHP

    Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.

    Published 25 Jul 2016 · NVD
  27. Critical 9.8

    CVE-2016-6295 · PHP

    ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.

    Published 25 Jul 2016 · NVD
  28. Critical 9.8

    CVE-2016-6294 · PHP

    The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.

    Published 25 Jul 2016 · NVD
  29. Medium 6.5

    CVE-2016-6292 · PHP

    The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.

    Published 25 Jul 2016 · NVD
  30. Critical 9.8

    CVE-2016-6291 · PHP

    The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.

    Published 25 Jul 2016 · NVD
  31. Critical 9.8

    CVE-2016-6290 · PHP

    ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.

    Published 25 Jul 2016 · NVD
  32. High 7.8

    CVE-2016-6289 · PHP

    Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.

    Published 25 Jul 2016 · NVD
  33. Critical 9.8

    CVE-2016-6288 · PHP

    The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.

    Published 25 Jul 2016 · NVD
  34. Low 3.7

    CVE-2016-5444 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection.

    Published 21 Jul 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  35. Medium 4.7

    CVE-2016-5443 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows local users to affect availability via vectors related to Server: Connection.

    Published 21 Jul 2016 · NVD
  36. Medium 4.9

    CVE-2016-5442 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Encryption.

    Published 21 Jul 2016 · NVD
  37. Medium 4.9

    CVE-2016-5441 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Replication.

    Published 21 Jul 2016 · NVD
  38. Medium 4.9

    CVE-2016-5440 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR.

    Published 21 Jul 2016 · Fixed in 5.5.50, 10.0.26, 10.1.15 · NVD
  39. Medium 4.9

    CVE-2016-5439 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Privileges.

    Published 21 Jul 2016 · NVD
  40. Medium 4.9

    CVE-2016-5437 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Log.

    Published 21 Jul 2016 · NVD
  41. Medium 4.9

    CVE-2016-5436 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 21 Jul 2016 · NVD
  42. Medium 5.3

    CVE-2016-3615 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: DML.

    Published 21 Jul 2016 · Fixed in 5.5.50, 10.0.26, 10.1.15 · NVD
  43. Medium 5.3

    CVE-2016-3614 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Security: Encryption.

    Published 21 Jul 2016 · NVD
  44. Critical 9.6

    CVE-2016-3610 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598.

    Published 21 Jul 2016 · NVD
  45. Critical 9.6

    CVE-2016-3606 · Java

    Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

    Published 21 Jul 2016 · NVD
  46. Critical 9.6

    CVE-2016-3598 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.

    Published 21 Jul 2016 · NVD
  47. Medium 5.9

    CVE-2016-3588 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote authenticated users to affect integrity and availability via vectors related to Server: InnoDB.

    Published 21 Jul 2016 · NVD
  48. Critical 9.6

    CVE-2016-3587 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

    Published 21 Jul 2016 · NVD
  49. High 8.1

    CVE-2016-3552 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

    Published 21 Jul 2016 · NVD
  50. Medium 4.3

    CVE-2016-3550 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot.

    Published 21 Jul 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.