Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,367
- Published in 7 days
- 256
- Critical in 30 days
- 76
- Actively exploited
- 66
Latest vulnerabilities
11,367 vulnerabilities- High 7.5
CVE-2016-5836 · WordPress
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
Published 29 Jun 2016 · NVD - High 7.5
CVE-2016-5835 · WordPress
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Published 29 Jun 2016 · NVD - Medium 6.1
CVE-2016-5834 · WordPress
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
Published 29 Jun 2016 · NVD - Medium 6.1
CVE-2016-5833 · WordPress
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Published 29 Jun 2016 · NVD - High 7.5
CVE-2016-5832 · WordPress
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
Published 29 Jun 2016 · NVD - High 7.8
CVE-2016-4802 · curl
Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll, (2) secur32.dll, or (3) ws2_32.dll in the application or current working directory.
Published 24 Jun 2016 · NVD - Medium 5.5
CVE-2016-2178 · Node.js, OpenSSL
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
Published 20 Jun 2016 · Fixed in 0.12.16, 4.6.0, 6.7.0 · NVD - Critical 9.8
CVE-2016-2177 · OpenSSL
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
Published 20 Jun 2016 · NVD - Unrated
WPV-beefcad79b61 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 20 Jun 2016 · Fixed in 4.0.4 · WPVulnerability - Medium 6.1
CVE-2016-10705 · Jetpack
Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting
Published 20 Jun 2016 · Fixed in 4.0.4 · NVD, WPVulnerability - Unrated
WPV-fb264eab4f92 · Yoast SEO
Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Published 14 Jun 2016 · Fixed in 3.3.0 · WPVulnerability - Unrated
WPV-7f2619adec9d · Yoast SEO
Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Published 14 Jun 2016 · Fixed in 3.3.0 · WPVulnerability - Medium 5.9
CVE-2013-7440 · Python
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
Published 7 Jun 2016 · NVD - High 7.5
CVE-2016-4450 · nginx
os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.
Published 7 Jun 2016 · Fixed in 1.10.1 · NVD - High 7.8
CVE-2016-3697 · Docker Engine
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Published 1 Jun 2016 · NVD - Critical 9.8
CVE-2016-0718 · Python
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Published 26 May 2016 · Fixed in 3.4.7, 3.5.4, 3.6.2 · NVD - Unrated
WPV-cc4617da308d · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 26 May 2016 · Fixed in 4.0.3 · WPVulnerability - Medium 6.1
CVE-2016-4567 · WordPress
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Published 22 May 2016 · NVD - Medium 6.1
CVE-2016-4566 · WordPress
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4544 · PHP
The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
Published 22 May 2016 · Fixed in 5.5.35, 5.6.21, 7.0.6 · NVD - Critical 9.8
CVE-2016-4543 · PHP
The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4542 · PHP
The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4541 · PHP
The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4540 · PHP
The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4539 · PHP
The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4538 · PHP
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4537 · PHP
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2016-4346 · PHP
Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Published 22 May 2016 · Fixed in 7.0.4 · NVD - Critical 9.8
CVE-2016-4345 · PHP
Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Published 22 May 2016 · Fixed in 7.0.4 · NVD - Critical 9.8
CVE-2016-4344 · PHP
Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long argument to the utf8_encode function, leading to a heap-based buffer overflow.
Published 22 May 2016 · Fixed in 7.0.4 · NVD - High 8.8
CVE-2016-4343 · PHP
The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.
Published 22 May 2016 · Fixed in 5.5.36, 5.6.18, 7.0.3 · NVD - High 8.8
CVE-2016-4342 · PHP
ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive.
Published 22 May 2016 · NVD - High 8.6
CVE-2016-2222 · WordPress
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
Published 22 May 2016 · NVD - High 7.4
CVE-2016-2221 · WordPress
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
Published 22 May 2016 · NVD - Medium 6.1
CVE-2016-1564 · WordPress
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2015-8880 · PHP
Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
Published 22 May 2016 · NVD - High 7.5
CVE-2015-8879 · PHP
The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.
Published 22 May 2016 · Fixed in 5.5.38, 5.6.12 · NVD - Medium 5.9
CVE-2015-8878 · PHP
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
Published 22 May 2016 · Fixed in 5.5.28, 5.6.12 · NVD - High 7.5
CVE-2015-8877 · PHP
The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Published 22 May 2016 · NVD - Critical 9.8
CVE-2015-8876 · PHP
Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
Published 22 May 2016 · Fixed in 5.4.44, 5.5.28, 5.6.12 · NVD - High 7.5
CVE-2015-8867 · PHP
The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Published 22 May 2016 · Fixed in 5.4.44, 5.5.28, 5.6.12 · NVD - Critical 9.6
CVE-2015-8866 · PHP
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Published 22 May 2016 · Fixed in 7.0.27, 7.1.13, 7.2.1 · NVD - Medium 6.1
CVE-2015-8834 · WordPress
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
Published 22 May 2016 · NVD - Medium 5.4
CVE-2015-7989 · WordPress
Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
Published 22 May 2016 · NVD - Medium 4.3
CVE-2015-5715 · WordPress
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
Published 22 May 2016 · NVD - Medium 6.1
CVE-2015-5714 · WordPress
Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Published 22 May 2016 · NVD - Medium 4.3
CVE-2014-9767 · PHP
Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.
Published 22 May 2016 · NVD - Medium 5.3
CVE-2016-3739 · curl
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.
Published 20 May 2016 · NVD - Critical 9.8
CVE-2016-4073 · PHP
Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call.
Published 20 May 2016 · NVD - Critical 9.8
CVE-2016-4072 · PHP
The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.
Published 20 May 2016 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.