UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,460
Published in 7 days
311
Critical in 30 days
78
Actively exploited
66

Latest vulnerabilities

11,460 vulnerabilities
  1. Medium 4.3

    CVE-2015-2934 · MediaWiki

    MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

    Published 13 Apr 2015 · NVD
  2. Medium 4.3

    CVE-2015-2933 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant.

    Published 13 Apr 2015 · NVD
  3. Medium 4.3

    CVE-2015-2932 · MediaWiki

    Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.

    Published 13 Apr 2015 · NVD
  4. Medium 4.3

    CVE-2015-2931 · MediaWiki

    Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.

    Published 13 Apr 2015 · NVD
  5. Unrated

    CVE-2015-3429 · Twentyfifteen (WordPress theme)

    Twenty Fifteen: Cross-site Scripting

    Published 8 Apr 2015 · Fixed in 1.2 · WPVulnerability
  6. Unrated

    WPV-61aeaef9deb3 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 7 Apr 2015 · Fixed in 1.4.3 · WPVulnerability
  7. Medium 5.0

    CVE-2015-1609 · MongoDB

    MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.

    Published 30 Mar 2015 · NVD
  8. High 7.5

    CVE-2015-2787 · PHP

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

    Published 30 Mar 2015 · NVD
  9. Medium 5.0

    CVE-2015-2348 · PHP

    The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix…

    Published 30 Mar 2015 · NVD
  10. High 7.5

    CVE-2015-2331 · PHP

    Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer…

    Published 30 Mar 2015 · NVD
  11. Medium 6.8

    CVE-2015-2305 · PHP

    Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.

    Published 30 Mar 2015 · Fixed in 5.4.39, 5.5.23, 5.6.7 · NVD
  12. High 7.5

    CVE-2015-2301 · PHP

    Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

    Published 30 Mar 2015 · Fixed in 5.4.40, 5.5.22, 5.6.6 · NVD
  13. Medium 5.0

    CVE-2015-1352 · PHP

    The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.

    Published 30 Mar 2015 · Fixed in 5.4.40, 5.5.24, 5.6.8 · NVD
  14. High 7.5

    CVE-2015-1351 · PHP

    Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

    Published 30 Mar 2015 · Fixed in 5.5.24, 5.6.8 · NVD
  15. High 7.5

    CVE-2015-0273 · PHP

    Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the…

    Published 30 Mar 2015 · NVD
  16. Medium 5.0

    CVE-2014-9709 · PHP

    The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

    Published 30 Mar 2015 · Fixed in 5.4.40, 5.5.21, 5.6.5 · NVD
  17. High 7.5

    CVE-2014-9705 · PHP

    Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

    Published 30 Mar 2015 · NVD
  18. High 7.5

    CVE-2014-9653 · PHP

    readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.

    Published 30 Mar 2015 · NVD
  19. Medium 5.0

    CVE-2014-9652 · PHP

    The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a…

    Published 30 Mar 2015 · NVD
  20. Medium 4.6

    CVE-2013-6501 · PHP

    The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.

    Published 30 Mar 2015 · NVD
  21. Low 2.6

    CVE-2015-1787 · OpenSSL

    The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.

    Published 19 Mar 2015 · NVD
  22. Medium 5.0

    CVE-2015-0293 · OpenSSL

    The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.

    Published 19 Mar 2015 · NVD
  23. High 7.5

    CVE-2015-0292 · OpenSSL

    Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.

    Published 19 Mar 2015 · NVD
  24. Medium 5.0

    CVE-2015-0291 · OpenSSL

    The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by using an invalid signature_algorithms extension in the ClientHello message during a renegotiation.

    Published 19 Mar 2015 · NVD
  25. Medium 5.0

    CVE-2015-0290 · OpenSSL

    The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.

    Published 19 Mar 2015 · NVD
  26. Medium 5.0

    CVE-2015-0289 · OpenSSL

    The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related…

    Published 19 Mar 2015 · NVD
  27. Medium 5.0

    CVE-2015-0288 · OpenSSL

    The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.

    Published 19 Mar 2015 · NVD
  28. Medium 5.0

    CVE-2015-0287 · OpenSSL

    The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.

    Published 19 Mar 2015 · NVD
  29. Medium 5.0

    CVE-2015-0286 · OpenSSL

    The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.

    Published 19 Mar 2015 · NVD
  30. Medium 4.3

    CVE-2015-0285 · OpenSSL

    The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.

    Published 19 Mar 2015 · NVD
  31. Medium 6.8

    CVE-2015-0209 · OpenSSL

    Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly…

    Published 19 Mar 2015 · NVD
  32. Medium 4.3

    CVE-2015-0208 · OpenSSL

    The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted RSA PSS parameters to an endpoint that uses the certificate-verification feature.

    Published 19 Mar 2015 · NVD
  33. Medium 5.0

    CVE-2015-0207 · OpenSSL

    The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.

    Published 19 Mar 2015 · NVD
  34. Medium 6.1

    CVE-2015-2329 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 13 Mar 2015 · Fixed in 2.3.6 · NVD, WPVulnerability
  35. Unrated

    CVE-2015-2292 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: SQL Injection

    Published 11 Mar 2015 · Fixed in 1.7.4 · WPVulnerability
  36. Unrated

    CVE-2015-2293 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-Site Request Forgery (CSRF)

    Published 10 Mar 2015 · Fixed in 1.7.4 · WPVulnerability
  37. Medium 5.0

    CVE-2015-0228 · Apache HTTP Server

    The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.

    Published 8 Mar 2015 · NVD
  38. Critical 9.8Actively exploited

    CVE-2015-1427 · Elasticsearch

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    Published 17 Feb 2015 · Fixed in 1.3.8, 1.4.3 · NVD
  39. Medium 6.4

    CVE-2014-0227 · Apache Tomcat

    java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked…

    Published 16 Feb 2015 · NVD
  40. Unrated

    CVE-2015-1579 · Slider Revolution

    Slider Revolution: Path Traversal

    Published 11 Feb 2015 · WPVulnerability
  41. Unrated

    WPV-cb1d77d83774 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 3 Feb 2015 · Fixed in 1.9.51 · WPVulnerability
  42. Unrated

    WPV-48e52c8a0c82 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 3 Feb 2015 · Fixed in 1.9.51 · WPVulnerability
  43. Unrated

    CVE-2015-2069 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 29 Jan 2015 · Fixed in 2.2.11 · WPVulnerability
  44. High 10.0

    CVE-2015-0235 · PHP

    Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

    Published 28 Jan 2015 · Fixed in 5.4.38, 5.5.22, 5.6.6 · NVD
  45. Medium 6.8

    CVE-2015-0232 · PHP

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.

    Published 27 Jan 2015 · NVD
  46. High 7.5

    CVE-2015-0231 · PHP

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of…

    Published 27 Jan 2015 · NVD
  47. High 9.3

    CVE-2015-0437 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  48. Medium 4.0

    CVE-2015-0432 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  49. Medium 6.9

    CVE-2015-0421 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process.

    Published 21 Jan 2015 · NVD
  50. Low 1.9

    CVE-2015-0413 · Java

    Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.

    Published 21 Jan 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.