UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,375
Published in 7 days
264
Critical in 30 days
77
Actively exploited
66

Latest vulnerabilities

11,375 vulnerabilities
  1. Critical 9.8

    CVE-2016-3074 · PHP

    Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

    Published 26 Apr 2016 · Fixed in 5.5.35, 5.6.21, 7.0.6 · NVD
  2. High 8.3

    CVE-2016-3449 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.

    Published 21 Apr 2016 · NVD
  3. Critical 9.6

    CVE-2016-3443 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data, which triggers an…

    Published 21 Apr 2016 · NVD
  4. Critical 9.8Actively exploited

    CVE-2016-3427 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

    Published 21 Apr 2016 · NVD
  5. Low 3.1

    CVE-2016-3426 · Java

    Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE.

    Published 21 Apr 2016 · NVD
  6. Medium 4.3

    CVE-2016-3425 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP.

    Published 21 Apr 2016 · NVD
  7. Medium 4.3

    CVE-2016-3422 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect availability via vectors related to 2D.

    Published 21 Apr 2016 · NVD
  8. Medium 5.9

    CVE-2016-0695 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

    Published 21 Apr 2016 · NVD
  9. Critical 9.6

    CVE-2016-0687 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.

    Published 21 Apr 2016 · NVD
  10. Critical 9.6

    CVE-2016-0686 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.

    Published 21 Apr 2016 · NVD
  11. Medium 4.1

    CVE-2016-0668 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

    Published 21 Apr 2016 · Fixed in 10.0.24 · NVD
  12. Medium 4.4

    CVE-2016-0667 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Locking.

    Published 21 Apr 2016 · NVD
  13. Medium 5.5

    CVE-2016-0666 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  14. Medium 5.5

    CVE-2016-0665 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Security: Encryption.

    Published 21 Apr 2016 · NVD
  15. Medium 4.7

    CVE-2016-0663 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Performance Schema.

    Published 21 Apr 2016 · NVD
  16. Medium 5.5

    CVE-2016-0662 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Partition.

    Published 21 Apr 2016 · NVD
  17. Medium 4.7

    CVE-2016-0661 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options.

    Published 21 Apr 2016 · NVD
  18. Medium 5.5

    CVE-2016-0659 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Optimizer.

    Published 21 Apr 2016 · NVD
  19. Medium 5.5

    CVE-2016-0658 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Optimizer.

    Published 21 Apr 2016 · NVD
  20. Medium 5.5

    CVE-2016-0657 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect confidentiality via vectors related to JSON.

    Published 21 Apr 2016 · NVD
  21. Medium 5.5

    CVE-2016-0656 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability than CVE-2016-0654.

    Published 21 Apr 2016 · NVD
  22. Medium 4.7

    CVE-2016-0655 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to InnoDB.

    Published 21 Apr 2016 · Fixed in 10.0.25, 10.1.14 · NVD
  23. Medium 5.5

    CVE-2016-0654 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability than CVE-2016-0656.

    Published 21 Apr 2016 · NVD
  24. Medium 5.5

    CVE-2016-0653 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to FTS.

    Published 21 Apr 2016 · NVD
  25. Medium 5.5

    CVE-2016-0652 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to DML.

    Published 21 Apr 2016 · NVD
  26. Medium 5.5

    CVE-2016-0651 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

    Published 21 Apr 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  27. Medium 5.5

    CVE-2016-0650 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to Replication.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  28. Medium 5.5

    CVE-2016-0649 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to PS.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  29. Medium 5.5

    CVE-2016-0648 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to PS.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  30. Medium 5.5

    CVE-2016-0647 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to FTS.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  31. Medium 5.5

    CVE-2016-0646 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DML.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  32. Medium 5.5

    CVE-2016-0644 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DDL.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  33. Low 3.3

    CVE-2016-0643 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  34. Medium 4.7

    CVE-2016-0642 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.

    Published 21 Apr 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  35. Medium 5.1

    CVE-2016-0641 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect confidentiality and availability via vectors related to MyISAM.

    Published 21 Apr 2016 · Fixed in 10.0.24, 10.1.12 · NVD
  36. Medium 6.1

    CVE-2016-0640 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect integrity and availability via vectors related to DML.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  37. Critical 9.8

    CVE-2016-0639 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Pluggable Authentication.

    Published 21 Apr 2016 · NVD
  38. Medium 5.3

    CVE-2016-2212 · Magento / Adobe Commerce

    The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status.

    Published 15 Apr 2016 · NVD
  39. Critical 9.1

    CVE-2016-3065 · PostgreSQL

    The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequently obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.

    Published 11 Apr 2016 · NVD
  40. High 7.5

    CVE-2016-2193 · PostgreSQL

    PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions by leveraging a session that performs queries as more than one role.

    Published 11 Apr 2016 · NVD
  41. High 7.5

    CVE-2016-2216 · Node.js

    The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

    Published 7 Apr 2016 · NVD
  42. High 7.5

    CVE-2016-2086 · Node.js

    Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

    Published 7 Apr 2016 · NVD
  43. Medium 5.9

    CVE-2015-2774 · Erlang/OTP

    Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).

    Published 7 Apr 2016 · NVD
  44. High 8.2

    CVE-2016-3142 · PHP

    The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.

    Published 31 Mar 2016 · NVD
  45. Critical 9.8

    CVE-2016-3141 · PHP

    Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.

    Published 31 Mar 2016 · NVD
  46. High 8.1

    CVE-2016-0636 · Java

    Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.

    Published 24 Mar 2016 · NVD
  47. High 8.4

    CVE-2015-7551 · Ruby

    The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library.…

    Published 24 Mar 2016 · NVD
  48. Medium 6.4

    CVE-2016-3115 · OpenSSH

    Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

    Published 22 Mar 2016 · NVD
  49. Critical 9.8

    CVE-2016-2842 · OpenSSL

    The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different…

    Published 3 Mar 2016 · NVD
  50. Critical 9.8

    CVE-2016-0799 · OpenSSL

    The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.

    Published 3 Mar 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.