UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,375
Published in 7 days
242
Critical in 30 days
77
Actively exploited
66

Latest vulnerabilities

11,375 vulnerabilities
  1. Medium 4.0

    CVE-2015-4833 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.

    Published 21 Oct 2015 · NVD
  2. Medium 4.0

    CVE-2015-4830 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  3. Medium 4.0

    CVE-2015-4826 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  4. High 7.2

    CVE-2015-4819 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs.

    Published 21 Oct 2015 · Fixed in 5.5.45, 10.0.21, 10.1.8 · NVD
  5. Medium 4.0

    CVE-2015-4816 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

    Published 21 Oct 2015 · Fixed in 5.5.45, 10.0.21, 10.1.8 · NVD
  6. Medium 4.0

    CVE-2015-4815 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  7. Medium 6.9

    CVE-2015-4810 · Java

    Unspecified vulnerability in Oracle Java SE 7u85 and 8u60 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 21 Oct 2015 · NVD
  8. Low 3.5

    CVE-2015-4807 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  9. Medium 6.4

    CVE-2015-4806 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

    Published 21 Oct 2015 · NVD
  10. High 10.0

    CVE-2015-4805 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

    Published 21 Oct 2015 · NVD
  11. Medium 5.0

    CVE-2015-4803 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.

    Published 21 Oct 2015 · NVD
  12. Medium 4.0

    CVE-2015-4802 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  13. Medium 4.0

    CVE-2015-4800 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

    Published 21 Oct 2015 · NVD
  14. Low 1.7

    CVE-2015-4792 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  15. Low 3.5

    CVE-2015-4791 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 21 Oct 2015 · NVD
  16. Low 1.9

    CVE-2015-4766 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall.

    Published 21 Oct 2015 · NVD
  17. Medium 5.0

    CVE-2015-4734 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.

    Published 21 Oct 2015 · NVD
  18. Medium 4.0

    CVE-2015-4730 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.20 and earlier allows remote authenticated users to affect availability via unknown vectors related to Types.

    Published 21 Oct 2015 · NVD
  19. Unrated

    WPV-7c991982251b · Akismet (WordPress plugin)

    Vulnerability in Akismet Anti-spam: Spam Protection

    Published 13 Oct 2015 · Fixed in 3.1.5 · WPVulnerability
  20. Medium 6.1

    CVE-2015-9357 · Akismet (WordPress plugin)

    Akismet Anti-spam: Spam Protection: Cross-site Scripting

    Published 13 Oct 2015 · Fixed in 3.1.5 · WPVulnerability
  21. High 7.2

    CVE-2015-5652 · Python

    Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."

    Published 6 Oct 2015 · NVD
  22. Unrated

    WPV-d6643ccca9c5 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.2 · WPVulnerability
  23. Unrated

    WPV-861c42a54d27 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.1 · WPVulnerability
  24. Unrated

    WPV-46617b404f70 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.2 · WPVulnerability
  25. Unrated

    WPV-185052db41ab · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.1 · WPVulnerability
  26. Unrated

    WPV-b28039f3e2cf · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 26 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  27. Unrated

    WPV-22a8df67b13a · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 26 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  28. Unrated

    WPV-822eb8c8780d · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  29. Unrated

    WPV-64658a4f2f13 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  30. Unrated

    WPV-191aaebdae4e · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  31. Medium 4.3

    CVE-2015-6939 · Joomla!

    Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 18 Sept 2015 · NVD
  32. Unrated

    WPV-eb2f04ae656c · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 9 Sept 2015 · Fixed in 2.2.6.2 · WPVulnerability
  33. Medium 4.3

    CVE-2015-6734 · MediaWiki

    Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 1 Sept 2015 · NVD
  34. Medium 5.0

    CVE-2015-6733 · MediaWiki

    GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.

    Published 1 Sept 2015 · NVD
  35. Medium 4.3

    CVE-2015-6730 · MediaWiki

    Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."

    Published 1 Sept 2015 · NVD
  36. Medium 4.3

    CVE-2015-6729 · MediaWiki

    Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.

    Published 1 Sept 2015 · NVD
  37. High 7.5

    CVE-2015-6728 · MediaWiki

    The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.

    Published 1 Sept 2015 · NVD
  38. Medium 5.0

    CVE-2015-6727 · MediaWiki

    The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.

    Published 1 Sept 2015 · NVD
  39. Medium 5.0

    CVE-2013-7444 · MediaWiki

    The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.

    Published 1 Sept 2015 · NVD
  40. High 7.2

    CVE-2015-6565 · OpenSSH

    sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.

    Published 24 Aug 2015 · NVD
  41. High 7.0

    CVE-2015-6564 · OpenSSH

    Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

    Published 24 Aug 2015 · NVD
  42. Medium 6.4

    CVE-2015-6563 · OpenSSH

    The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.

    Published 24 Aug 2015 · NVD
  43. Medium 4.3

    CVE-2015-3439 · WordPress

    Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

    Published 5 Aug 2015 · NVD
  44. Medium 4.3

    CVE-2015-3438 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.

    Published 5 Aug 2015 · NVD
  45. Medium 4.0

    CVE-2015-5623 · WordPress

    WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.

    Published 3 Aug 2015 · NVD
  46. Low 3.5

    CVE-2015-5622 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

    Published 3 Aug 2015 · NVD
  47. Medium 4.3

    CVE-2015-3440 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.

    Published 3 Aug 2015 · NVD
  48. High 8.1

    CVE-2015-5600 · OpenSSH

    The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a…

    Published 3 Aug 2015 · NVD
  49. Medium 4.3

    CVE-2015-5352 · OpenSSH

    The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.

    Published 3 Aug 2015 · NVD
  50. Medium 6.8

    CVE-2015-1283 · Python

    Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.

    Published 23 Jul 2015 · Fixed in 3.3.7, 3.4.5, 3.5.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.