UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,367
Published in 7 days
256
Critical in 30 days
76
Actively exploited
66

Latest vulnerabilities

11,367 vulnerabilities
  1. Medium 4.9

    CVE-2016-5439 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Privileges.

    Published 21 Jul 2016 · NVD
  2. Medium 4.9

    CVE-2016-5437 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Log.

    Published 21 Jul 2016 · NVD
  3. Medium 4.9

    CVE-2016-5436 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 21 Jul 2016 · NVD
  4. Medium 5.3

    CVE-2016-3615 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: DML.

    Published 21 Jul 2016 · Fixed in 5.5.50, 10.0.26, 10.1.15 · NVD
  5. Medium 5.3

    CVE-2016-3614 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Security: Encryption.

    Published 21 Jul 2016 · NVD
  6. Critical 9.6

    CVE-2016-3610 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598.

    Published 21 Jul 2016 · NVD
  7. Critical 9.6

    CVE-2016-3606 · Java

    Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

    Published 21 Jul 2016 · NVD
  8. Critical 9.6

    CVE-2016-3598 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.

    Published 21 Jul 2016 · NVD
  9. Medium 5.9

    CVE-2016-3588 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote authenticated users to affect integrity and availability via vectors related to Server: InnoDB.

    Published 21 Jul 2016 · NVD
  10. Critical 9.6

    CVE-2016-3587 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

    Published 21 Jul 2016 · NVD
  11. High 8.1

    CVE-2016-3552 · Java

    Unspecified vulnerability in Oracle Java SE 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

    Published 21 Jul 2016 · NVD
  12. Medium 4.3

    CVE-2016-3550 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot.

    Published 21 Jul 2016 · NVD
  13. Medium 6.5

    CVE-2016-3521 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: Types.

    Published 21 Jul 2016 · Fixed in 5.5.50, 10.0.26, 10.1.15 · NVD
  14. Medium 6.5

    CVE-2016-3518 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

    Published 21 Jul 2016 · NVD
  15. High 7.7

    CVE-2016-3511 · Java

    Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment.

    Published 21 Jul 2016 · NVD
  16. Medium 5.3

    CVE-2016-3508 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.

    Published 21 Jul 2016 · NVD
  17. High 7.7

    CVE-2016-3503 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

    Published 21 Jul 2016 · NVD
  18. Medium 6.5

    CVE-2016-3501 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

    Published 21 Jul 2016 · NVD
  19. Medium 5.3

    CVE-2016-3500 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508.

    Published 21 Jul 2016 · NVD
  20. Medium 5.3

    CVE-2016-3498 · Java

    Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows remote attackers to affect availability via vectors related to JavaFX.

    Published 21 Jul 2016 · NVD
  21. Medium 6.5

    CVE-2016-3486 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: FTS.

    Published 21 Jul 2016 · NVD
  22. Low 2.9

    CVE-2016-3485 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking.

    Published 21 Jul 2016 · NVD
  23. High 8.1

    CVE-2016-3477 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser.

    Published 21 Jul 2016 · Fixed in 5.5.50, 10.0.26, 10.1.15 · NVD
  24. High 7.5

    CVE-2016-3471 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.45 and earlier and 5.6.26 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Option.

    Published 21 Jul 2016 · Fixed in 5.5.46, 10.0.22, 10.1.9 · NVD
  25. Medium 4.9

    CVE-2016-3459 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 21 Jul 2016 · Fixed in 10.0.25, 10.1.14 · NVD
  26. Medium 4.3

    CVE-2016-3458 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA.

    Published 21 Jul 2016 · NVD
  27. Low 3.7

    CVE-2016-3452 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption.

    Published 21 Jul 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  28. High 7.7

    CVE-2016-3440 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

    Published 21 Jul 2016 · NVD
  29. Medium 4.9

    CVE-2016-3424 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer.

    Published 21 Jul 2016 · NVD
  30. Unrated

    WPV-7e9742981174 · WooCommerce

    Vulnerability in WooCommerce

    Published 20 Jul 2016 · Fixed in 2.6.3 · WPVulnerability
  31. High 8.1

    CVE-2016-5388 · Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an…

    Published 19 Jul 2016 · NVD
  32. High 8.1

    CVE-2016-5387 · Apache HTTP Server

    The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the…

    Published 19 Jul 2016 · NVD
  33. High 8.1

    CVE-2016-5385 · PHP

    PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by…

    Published 19 Jul 2016 · Fixed in 5.5.38, 5.6.24 · NVD
  34. Unrated

    WPV-85317a68f1e8 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 19 Jul 2016 · Fixed in 2.3.8 · WPVulnerability
  35. Unrated

    WPV-64d7067d0d7a · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 19 Jul 2016 · Fixed in 2.3.7 · WPVulnerability
  36. Unrated

    WPV-412b3bf50cb5 · WooCommerce

    Vulnerability in WooCommerce

    Published 19 Jul 2016 · Fixed in 2.6.3 · WPVulnerability
  37. Unrated

    WPV-eeb64da477e4 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 13 Jul 2016 · Fixed in 2.3.8 · WPVulnerability
  38. High 8.1

    CVE-2016-6174 · PHP

    applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.

    Published 12 Jul 2016 · NVD
  39. Unrated

    WPV-6a93a8c702ad · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 11 Jul 2016 · Fixed in 2.3.6.2 · WPVulnerability
  40. High 7.5

    CVE-2016-4979 · Apache HTTP Server

    The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.

    Published 6 Jul 2016 · NVD
  41. Medium 5.9

    CVE-2016-1546 · Apache HTTP Server

    The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.

    Published 6 Jul 2016 · NVD
  42. High 7.5

    CVE-2016-3092 · Apache Tomcat

    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

    Published 4 Jul 2016 · NVD
  43. High 7.5

    CVE-2016-3956 · Node.js

    The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

    Published 2 Jul 2016 · NVD
  44. Unrated

    WPV-c3e670cbbc4c · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 1 Jul 2016 · Fixed in 2.3.7 · WPVulnerability
  45. High 7.5

    CVE-2016-5360 · HAProxy

    HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.

    Published 30 Jun 2016 · NVD
  46. High 8.1

    CVE-2016-4472 · Python

    The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

    Published 30 Jun 2016 · Fixed in 3.4.7, 3.5.4, 3.6.2 · NVD
  47. Medium 6.5

    CVE-2016-3189 · Python

    Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

    Published 30 Jun 2016 · Fixed in 3.8.13, 3.9.11, 3.10.3 · NVD
  48. High 7.5

    CVE-2016-5839 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.

    Published 29 Jun 2016 · NVD
  49. High 7.5

    CVE-2016-5838 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.

    Published 29 Jun 2016 · NVD
  50. High 7.5

    CVE-2016-5837 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.

    Published 29 Jun 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.