UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,406
Published in 7 days
257
Critical in 30 days
78
Actively exploited
66

Latest vulnerabilities

11,406 vulnerabilities
  1. Unrated

    WPV-98fe49343dfe · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 20 Apr 2015 · Fixed in 1.9.6.4 · WPVulnerability
  2. Unrated

    WPV-92afc7a45f4d · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 20 Apr 2015 · Fixed in 1.9.6.4 · WPVulnerability
  3. Unrated

    WPV-64ab3d07f7dd · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 20 Apr 2015 · Fixed in 3.4.3 · WPVulnerability
  4. Unrated

    WPV-2f093ee917a5 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
  5. Medium 6.1

    CVE-2015-9359 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 20 Apr 2015 · Fixed in 3.4.3 · NVD, WPVulnerability
  6. Low 2.1

    CVE-2015-2576 · MySQL

    Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.

    Published 16 Apr 2015 · NVD
  7. Medium 4.0

    CVE-2015-2573 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  8. Medium 4.0

    CVE-2015-2571 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  9. Medium 5.0

    CVE-2015-2568 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  10. Low 3.5

    CVE-2015-2567 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 16 Apr 2015 · NVD
  11. Low 2.8

    CVE-2015-2566 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 16 Apr 2015 · NVD
  12. Low 2.8

    CVE-2015-0511 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP.

    Published 16 Apr 2015 · NVD
  13. Medium 4.0

    CVE-2015-0508 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.

    Published 16 Apr 2015 · NVD
  14. Low 3.5

    CVE-2015-0507 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

    Published 16 Apr 2015 · NVD
  15. Low 3.5

    CVE-2015-0506 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2015-0508.

    Published 16 Apr 2015 · NVD
  16. Low 3.5

    CVE-2015-0505 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  17. Medium 4.0

    CVE-2015-0503 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.

    Published 16 Apr 2015 · NVD
  18. Medium 5.7

    CVE-2015-0501 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  19. Medium 4.0

    CVE-2015-0500 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors.

    Published 16 Apr 2015 · NVD
  20. Low 3.5

    CVE-2015-0499 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  21. Low 1.7

    CVE-2015-0498 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.

    Published 16 Apr 2015 · NVD
  22. High 9.3

    CVE-2015-0492 · Java

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.

    Published 16 Apr 2015 · NVD
  23. High 10.0

    CVE-2015-0491 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459.

    Published 16 Apr 2015 · NVD
  24. Medium 5.0

    CVE-2015-0488 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.

    Published 16 Apr 2015 · NVD
  25. Medium 5.0

    CVE-2015-0486 · Java

    Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

    Published 16 Apr 2015 · NVD
  26. Medium 6.8

    CVE-2015-0484 · Java

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0492.

    Published 16 Apr 2015 · NVD
  27. Medium 5.8

    CVE-2015-0480 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

    Published 16 Apr 2015 · NVD
  28. Medium 4.3

    CVE-2015-0478 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE.

    Published 16 Apr 2015 · NVD
  29. Medium 4.3

    CVE-2015-0477 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.

    Published 16 Apr 2015 · NVD
  30. Medium 4.3

    CVE-2015-0470 · Java

    Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot.

    Published 16 Apr 2015 · NVD
  31. High 10.0

    CVE-2015-0469 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 16 Apr 2015 · NVD
  32. High 9.3

    CVE-2015-0460 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 16 Apr 2015 · NVD
  33. High 10.0

    CVE-2015-0459 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491.

    Published 16 Apr 2015 · NVD
  34. High 7.6

    CVE-2015-0458 · Java

    Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 16 Apr 2015 · NVD
  35. Medium 4.0

    CVE-2015-0441 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  36. Medium 4.0

    CVE-2015-0439 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756.

    Published 16 Apr 2015 · NVD
  37. Medium 4.0

    CVE-2015-0438 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.

    Published 16 Apr 2015 · NVD
  38. Medium 4.0

    CVE-2015-0433 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  39. Medium 4.0

    CVE-2015-0423 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 16 Apr 2015 · NVD
  40. Medium 4.0

    CVE-2015-0405 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.

    Published 16 Apr 2015 · NVD
  41. High 7.1

    CVE-2015-2942 · MediaWiki

    MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.

    Published 13 Apr 2015 · NVD
  42. Medium 4.3

    CVE-2015-2941 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.

    Published 13 Apr 2015 · NVD
  43. Medium 4.3

    CVE-2015-2938 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file.

    Published 13 Apr 2015 · NVD
  44. High 7.1

    CVE-2015-2937 · MediaWiki

    MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942.

    Published 13 Apr 2015 · NVD
  45. High 7.1

    CVE-2015-2936 · MediaWiki

    MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password.

    Published 13 Apr 2015 · NVD
  46. Medium 5.0

    CVE-2015-2935 · MediaWiki

    MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."

    Published 13 Apr 2015 · NVD
  47. Medium 4.3

    CVE-2015-2934 · MediaWiki

    MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

    Published 13 Apr 2015 · NVD
  48. Medium 4.3

    CVE-2015-2933 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant.

    Published 13 Apr 2015 · NVD
  49. Medium 4.3

    CVE-2015-2932 · MediaWiki

    Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.

    Published 13 Apr 2015 · NVD
  50. Medium 4.3

    CVE-2015-2931 · MediaWiki

    Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.

    Published 13 Apr 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.