UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,524
Published in 7 days
367
Critical in 30 days
105
Actively exploited
66

Latest vulnerabilities

11,524 vulnerabilities
  1. Medium 5.0

    CVE-2015-0228 · Apache HTTP Server

    The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.

    Published 8 Mar 2015 · NVD
  2. Critical 9.8Actively exploited

    CVE-2015-1427 · Elasticsearch

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    Published 17 Feb 2015 · Fixed in 1.3.8, 1.4.3 · NVD
  3. Medium 6.4

    CVE-2014-0227 · Apache Tomcat

    java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked…

    Published 16 Feb 2015 · NVD
  4. Unrated

    CVE-2015-1579 · Slider Revolution

    Slider Revolution: Path Traversal

    Published 11 Feb 2015 · WPVulnerability
  5. Unrated

    WPV-cb1d77d83774 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 3 Feb 2015 · Fixed in 1.9.51 · WPVulnerability
  6. Unrated

    WPV-48e52c8a0c82 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 3 Feb 2015 · Fixed in 1.9.51 · WPVulnerability
  7. Unrated

    CVE-2015-2069 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 29 Jan 2015 · Fixed in 2.2.11 · WPVulnerability
  8. High 10.0

    CVE-2015-0235 · PHP

    Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

    Published 28 Jan 2015 · Fixed in 5.4.38, 5.5.22, 5.6.6 · NVD
  9. Medium 6.8

    CVE-2015-0232 · PHP

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.

    Published 27 Jan 2015 · NVD
  10. High 7.5

    CVE-2015-0231 · PHP

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of…

    Published 27 Jan 2015 · NVD
  11. High 9.3

    CVE-2015-0437 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  12. Medium 4.0

    CVE-2015-0432 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  13. Medium 6.9

    CVE-2015-0421 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process.

    Published 21 Jan 2015 · NVD
  14. Low 1.9

    CVE-2015-0413 · Java

    Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.

    Published 21 Jan 2015 · NVD
  15. High 7.2

    CVE-2015-0412 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.

    Published 21 Jan 2015 · NVD
  16. High 7.5

    CVE-2015-0411 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  17. Medium 5.0

    CVE-2015-0410 · Java

    Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.

    Published 21 Jan 2015 · NVD
  18. Medium 4.0

    CVE-2015-0409 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2015 · NVD
  19. High 10.0

    CVE-2015-0408 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.

    Published 21 Jan 2015 · NVD
  20. Medium 5.0

    CVE-2015-0407 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.

    Published 21 Jan 2015 · NVD
  21. Medium 5.8

    CVE-2015-0406 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.

    Published 21 Jan 2015 · NVD
  22. Medium 6.9

    CVE-2015-0403 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 21 Jan 2015 · NVD
  23. Medium 5.0

    CVE-2015-0400 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 21 Jan 2015 · NVD
  24. High 9.3

    CVE-2015-0395 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  25. Medium 4.0

    CVE-2015-0391 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 21 Jan 2015 · Fixed in 5.5.39, 10.0.13 · NVD
  26. Low 3.5

    CVE-2015-0385 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth.

    Published 21 Jan 2015 · NVD
  27. Medium 5.4

    CVE-2015-0383 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  28. Medium 4.3

    CVE-2015-0382 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  29. Medium 4.3

    CVE-2015-0381 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  30. Low 3.5

    CVE-2015-0374 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  31. High 10.0

    CVE-2014-6601 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  32. Medium 4.0

    CVE-2014-6593 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

    Published 21 Jan 2015 · NVD
  33. Low 2.6

    CVE-2014-6591 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585.

    Published 21 Jan 2015 · NVD
  34. Medium 4.3

    CVE-2014-6587 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 21 Jan 2015 · NVD
  35. Low 2.6

    CVE-2014-6585 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.

    Published 21 Jan 2015 · NVD
  36. Low 3.5

    CVE-2014-6568 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  37. High 10.0

    CVE-2014-6549 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 21 Jan 2015 · NVD
  38. Medium 4.3

    CVE-2014-9480 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts.

    Published 16 Jan 2015 · NVD
  39. Medium 4.3

    CVE-2014-9479 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox.

    Published 16 Jan 2015 · NVD
  40. Low 2.6

    CVE-2014-9478 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.

    Published 16 Jan 2015 · NVD
  41. Medium 4.3

    CVE-2014-9477 · MediaWiki

    Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter.

    Published 16 Jan 2015 · NVD
  42. Medium 5.0

    CVE-2014-9476 · MediaWiki

    MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/."

    Published 16 Jan 2015 · NVD
  43. Low 3.5

    CVE-2014-9475 · MediaWiki

    Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.

    Published 16 Jan 2015 · NVD
  44. Medium 5.8

    CVE-2014-8151 · curl

    The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

    Published 15 Jan 2015 · NVD
  45. Medium 4.3

    CVE-2014-8150 · curl

    CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

    Published 15 Jan 2015 · NVD
  46. Medium 5.0

    CVE-2015-0206 · OpenSSL

    Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.

    Published 9 Jan 2015 · NVD
  47. Medium 5.0

    CVE-2015-0205 · OpenSSL

    The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority…

    Published 9 Jan 2015 · NVD
  48. Medium 4.3

    CVE-2015-0204 · OpenSSL

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not…

    Published 9 Jan 2015 · NVD
  49. Medium 5.0

    CVE-2014-8275 · OpenSSL

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and…

    Published 9 Jan 2015 · NVD
  50. Medium 5.0

    CVE-2014-3572 · OpenSSL

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

    Published 9 Jan 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.