UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,375
Published in 7 days
263
Critical in 30 days
77
Actively exploited
66

Latest vulnerabilities

11,375 vulnerabilities
  1. High 7.5

    CVE-2016-0798 · OpenSSL

    Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c.

    Published 3 Mar 2016 · NVD
  2. High 7.5

    CVE-2016-0797 · Node.js, OpenSSL

    Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

    Published 3 Mar 2016 · Fixed in 4.1.2, 4.3.2, 5.7.1 · NVD
  3. Critical 9.8

    CVE-2016-0705 · OpenSSL, MySQL

    Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

    Published 3 Mar 2016 · NVD
  4. Medium 5.1

    CVE-2016-0702 · Node.js, OpenSSL

    The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a…

    Published 3 Mar 2016 · Fixed in 4.3.2, 5.7.1 · NVD
  5. Medium 5.9

    CVE-2016-0704 · OpenSSL

    An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding…

    Published 2 Mar 2016 · NVD
  6. Medium 5.9

    CVE-2016-0703 · OpenSSL

    The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA…

    Published 2 Mar 2016 · NVD
  7. Medium 5.9

    CVE-2016-0800 · OpenSSL

    The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

    Published 1 Mar 2016 · NVD
  8. Medium 6.3

    CVE-2016-0763 · Apache Tomcat

    The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a…

    Published 25 Feb 2016 · NVD
  9. High 8.8

    CVE-2016-0714 · Apache Tomcat

    The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

    Published 25 Feb 2016 · NVD
  10. Medium 4.3

    CVE-2016-0706 · Apache Tomcat

    Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via…

    Published 25 Feb 2016 · NVD
  11. High 8.8

    CVE-2015-5351 · Apache Tomcat

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

    Published 25 Feb 2016 · NVD
  12. High 8.1

    CVE-2015-5346 · Apache Tomcat

    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

    Published 25 Feb 2016 · NVD
  13. Medium 5.3

    CVE-2015-5345 · Apache Tomcat

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

    Published 25 Feb 2016 · NVD
  14. Medium 4.3

    CVE-2015-5174 · Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the…

    Published 25 Feb 2016 · NVD
  15. Unrated

    WPV-afa17fa54578 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 25 Feb 2016 · Fixed in 3.9.2 · WPVulnerability
  16. Unrated

    WPV-1be51d91184a · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 25 Feb 2016 · Fixed in 3.9.2 · WPVulnerability
  17. Unrated

    WPV-10ec9a655813 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 25 Feb 2016 · Fixed in 3.9.2 · WPVulnerability
  18. High 7.5

    CVE-2016-0773 · PostgreSQL

    PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.

    Published 17 Feb 2016 · NVD
  19. High 8.8

    CVE-2016-0766 · PostgreSQL

    PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.

    Published 17 Feb 2016 · Fixed in 9.2.15, 9.3.11, 9.4.6 · NVD
  20. Medium 5.3

    CVE-2016-0747 · nginx

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.

    Published 15 Feb 2016 · Fixed in 1.8.1, 1.9.10 · NVD
  21. Critical 9.8

    CVE-2016-0746 · nginx

    Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

    Published 15 Feb 2016 · Fixed in 1.9.10 · NVD
  22. High 7.5

    CVE-2016-0742 · nginx

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

    Published 15 Feb 2016 · Fixed in 1.8.1, 1.9.10 · NVD
  23. Low 3.7

    CVE-2016-0701 · OpenSSL

    The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

    Published 15 Feb 2016 · NVD
  24. Medium 5.9

    CVE-2015-3197 · OpenSSL

    ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

    Published 15 Feb 2016 · NVD
  25. High 7.6

    CVE-2016-0603 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted…

    Published 8 Feb 2016 · NVD
  26. High 7.3

    CVE-2016-0755 · curl

    The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

    Published 29 Jan 2016 · NVD
  27. Medium 5.3

    CVE-2016-0754 · curl

    cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

    Published 29 Jan 2016 · NVD
  28. Medium 5.9

    CVE-2016-2047 · MariaDB, MySQL

    The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…

    Published 27 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  29. Medium 5.9

    CVE-2015-7744 · MariaDB

    wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.

    Published 22 Jan 2016 · Fixed in 5.5.46, 10.0.22, 10.1.9 · NVD
  30. Medium 4.0

    CVE-2016-0616 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · NVD
  31. Medium 4.0

    CVE-2016-0611 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · NVD
  32. Low 3.5

    CVE-2016-0610 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 21 Jan 2016 · NVD
  33. Low 1.7

    CVE-2016-0609 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  34. Low 3.5

    CVE-2016-0608 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  35. Low 2.8

    CVE-2016-0607 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication.

    Published 21 Jan 2016 · NVD
  36. Low 3.5

    CVE-2016-0606 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  37. Low 2.1

    CVE-2016-0605 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors.

    Published 21 Jan 2016 · NVD
  38. Low 3.5

    CVE-2016-0601 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition.

    Published 21 Jan 2016 · NVD
  39. Low 3.5

    CVE-2016-0600 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  40. Low 3.5

    CVE-2016-0599 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · NVD
  41. Low 3.5

    CVE-2016-0598 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  42. Medium 4.0

    CVE-2016-0597 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  43. Medium 4.0

    CVE-2016-0596 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  44. Medium 4.0

    CVE-2016-0595 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · NVD
  45. Medium 4.3

    CVE-2016-0594 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · NVD
  46. High 7.2

    CVE-2016-0546 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that…

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  47. Medium 6.8

    CVE-2016-0505 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  48. Medium 6.8

    CVE-2016-0504 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503.

    Published 21 Jan 2016 · NVD
  49. Medium 4.0

    CVE-2016-0503 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504.

    Published 21 Jan 2016 · NVD
  50. Medium 6.5

    CVE-2016-0502 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · Fixed in 5.5.32, 10.0.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.