Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,406
- Published in 7 days
- 257
- Critical in 30 days
- 78
- Actively exploited
- 66
Latest vulnerabilities
11,406 vulnerabilities- High 7.5
CVE-2015-4022 · PHP
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Published 9 Jun 2015 · NVD - Medium 5.0
CVE-2015-4021 · PHP
The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
Published 9 Jun 2015 · NVD - Medium 6.8
CVE-2015-3330 · PHP
The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-3329 · PHP
Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.
Published 9 Jun 2015 · NVD - High 7.5
CVE-2015-3307 · PHP
The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
Published 9 Jun 2015 · NVD - Medium 5.8
CVE-2015-2783 · PHP
ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.
Published 9 Jun 2015 · NVD - Medium 5.0
CVE-2014-7810 · Apache Tomcat
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Published 7 Jun 2015 · NVD - High 7.8
CVE-2014-0230 · Apache Tomcat
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Published 7 Jun 2015 · NVD - Medium 4.3
CVE-2015-3165 · PostgreSQL
Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
Published 28 May 2015 · NVD - Low 3.7
CVE-2015-4000 · OpenSSL, Java
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Published 21 May 2015 · NVD - Low 3.6
CVE-2015-3631 · Docker Engine
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Published 18 May 2015 · NVD - High 7.2
CVE-2015-3630 · Docker Engine
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Published 18 May 2015 · NVD - High 7.2
CVE-2015-3627 · Docker Engine
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Published 18 May 2015 · NVD - High 10.0
CVE-2015-0278 · Node.js
libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
Published 18 May 2015 · Fixed in 0.10.37 · NVD - Unrated
WPV-fed8e858bf29 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 15 May 2015 · Fixed in 2.3.4 · WPVulnerability - Unrated
WPV-fc8e1afbc29b · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 15 May 2015 · Fixed in 0.9.4.1 · WPVulnerability - Unrated
WPV-e4f87b5e23e2 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 15 May 2015 · Fixed in 2.2.9 · WPVulnerability - Unrated
WPV-cf8ffe159f9a · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.5 · WPVulnerability - Unrated
WPV-bfba9e175276 · All in One SEO
Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Published 15 May 2015 · Fixed in 2.1.6 · WPVulnerability - Unrated
WPV-bb471c36f639 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.5 · WPVulnerability - Unrated
WPV-ba31b7c4ba78 · All in One SEO
Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Published 15 May 2015 · Fixed in 2.1.6 · WPVulnerability - Unrated
WPV-ba2b29b2a445 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.3 · WPVulnerability - Unrated
WPV-aa479f9eee49 · WP Super Cache (WordPress plugin)
Vulnerability in WP Super Cache
Published 15 May 2015 · Fixed in 1.3.1 · WPVulnerability - Unrated
WPV-9ec8d069904d · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.4 · WPVulnerability - Unrated
WPV-9b466df1ce34 · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.3.6 · WPVulnerability - Unrated
WPV-7e928e56b207 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.3 · WPVulnerability - Unrated
WPV-7b8fc9e88eae · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.0.13 · WPVulnerability - Unrated
WPV-509e0e77b8fe · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.7 · WPVulnerability - Unrated
WPV-3d6938b3fa19 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.3 · WPVulnerability - Unrated
WPV-361ffa3ca1a4 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.3.7 · WPVulnerability - Unrated
WPV-1db3331b4461 · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.0.18 · WPVulnerability - Unrated
WPV-0f62f5811d51 · WP Super Cache (WordPress plugin)
Vulnerability in WP Super Cache
Published 15 May 2015 · Fixed in 1.4.3 · WPVulnerability - Unrated
WPV-806319933a60 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 6 May 2015 · Fixed in 3.5.3 · WPVulnerability - Unrated
WPV-608914b2227f · Twentyfifteen (WordPress theme)
Vulnerability in Twenty Fifteen
Published 6 May 2015 · WPVulnerability - Unrated
WPV-2eb29006bbbd · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 6 May 2015 · Fixed in 3.5.3 · WPVulnerability - Medium 5.0
CVE-2015-3153 · curl
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Published 1 May 2015 · NVD - Medium 6.5
CVE-2015-3458 · Magento / Adobe Commerce
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue…
Published 29 Apr 2015 · NVD - Medium 5.0
CVE-2015-3457 · Magento / Adobe Commerce
Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
Published 29 Apr 2015 · NVD - Medium 6.5
CVE-2015-1399 · Magento / Adobe Commerce
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since…
Published 29 Apr 2015 · NVD - Medium 6.5
CVE-2015-1398 · Magento / Adobe Commerce
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the…
Published 29 Apr 2015 · NVD - Medium 6.5
CVE-2015-1397 · Magento / Adobe Commerce
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Published 29 Apr 2015 · NVD - High 7.5
CVE-2015-3416 · PHP
The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.
Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD - High 7.5
CVE-2015-3415 · PHP
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD - High 7.5
CVE-2015-3414 · PHP
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD - Medium 5.0
CVE-2015-3148 · curl
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
Published 24 Apr 2015 · NVD - High 7.5
CVE-2015-3145 · curl
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
Published 24 Apr 2015 · NVD - High 9.0
CVE-2015-3144 · curl
The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Published 24 Apr 2015 · NVD - Medium 5.0
CVE-2015-3143 · curl
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
Published 24 Apr 2015 · NVD - Unrated
WPV-f967e51cbb1c · All in One SEO
Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Published 20 Apr 2015 · Fixed in 2.2.6.2 · WPVulnerability - Unrated
WPV-e79447e47a65 · Yoast SEO
Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.