UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,525
Published in 7 days
367
Critical in 30 days
105
Actively exploited
66

Latest vulnerabilities

11,525 vulnerabilities
  1. Medium 6.8

    CVE-2014-3670 · PHP

    The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by…

    Published 29 Oct 2014 · NVD
  2. High 7.5

    CVE-2014-3669 · PHP

    Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.

    Published 29 Oct 2014 · NVD
  3. Medium 5.0

    CVE-2014-3668 · PHP

    Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument to the xmlrpc_set_type function or (2) a crafted argument to the xmlrpc_decode function, related to…

    Published 29 Oct 2014 · NVD
  4. High 7.5

    CVE-2003-1599 · WordPress

    PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable.

    Published 27 Oct 2014 · NVD
  5. Medium 4.3

    CVE-2012-2413 · Joomla!

    Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

    Published 20 Oct 2014 · NVD
  6. Medium 5.0

    CVE-2014-7191 · Node.js

    The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

    Published 19 Oct 2014 · NVD
  7. Medium 4.3

    CVE-2014-3568 · OpenSSL

    OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.

    Published 19 Oct 2014 · NVD
  8. High 7.1

    CVE-2014-3567 · OpenSSL

    Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.

    Published 19 Oct 2014 · NVD
  9. High 7.1

    CVE-2014-3513 · OpenSSL

    Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.

    Published 19 Oct 2014 · NVD
  10. Medium 4.0

    CVE-2014-6564 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB FULLTEXT SEARCH DML.

    Published 15 Oct 2014 · Fixed in 10.0.13 · NVD
  11. High 9.3

    CVE-2014-6562 · Java

    Unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  12. Medium 4.3

    CVE-2014-6559 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  13. Low 2.6

    CVE-2014-6558 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.

    Published 15 Oct 2014 · NVD
  14. Medium 6.5

    CVE-2014-6555 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  15. Low 2.1

    CVE-2014-6551 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality via vectors related to CLIENT:MYSQLADMIN.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  16. High 9.3

    CVE-2014-6532 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503.

    Published 15 Oct 2014 · NVD
  17. Medium 4.3

    CVE-2014-6531 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  18. Medium 6.5

    CVE-2014-6530 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to CLIENT:MYSQLDUMP.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  19. Low 2.6

    CVE-2014-6527 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476.

    Published 15 Oct 2014 · NVD
  20. Medium 4.0

    CVE-2014-6520 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:DDL.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  21. Medium 5.0

    CVE-2014-6519 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Hotspot.

    Published 15 Oct 2014 · NVD
  22. Medium 5.0

    CVE-2014-6517 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and Jrockit R27.8.3 and R28.3.3 allows remote attackers to affect confidentiality via vectors related to JAXP.

    Published 15 Oct 2014 · NVD
  23. Medium 5.0

    CVE-2014-6515 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  24. High 10.0

    CVE-2014-6513 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.

    Published 15 Oct 2014 · NVD
  25. Medium 4.3

    CVE-2014-6512 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  26. Medium 5.0

    CVE-2014-6511 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

    Published 15 Oct 2014 · NVD
  27. Medium 4.3

    CVE-2014-6507 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  28. Medium 6.8

    CVE-2014-6506 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  29. Medium 4.0

    CVE-2014-6505 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to SERVER:MEMORY STORAGE ENGINE.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  30. Medium 5.0

    CVE-2014-6504 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, and 7u67, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Hotspot.

    Published 15 Oct 2014 · NVD
  31. High 9.3

    CVE-2014-6503 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532.

    Published 15 Oct 2014 · NVD
  32. Low 2.6

    CVE-2014-6502 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  33. High 7.5

    CVE-2014-6500 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  34. Medium 4.3

    CVE-2014-6496 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  35. Medium 4.3

    CVE-2014-6495 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect availability via vectors related to SERVER:SSL:yaSSL.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  36. Medium 4.3

    CVE-2014-6494 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  37. High 7.6

    CVE-2014-6493 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532.

    Published 15 Oct 2014 · NVD
  38. High 7.6

    CVE-2014-6492 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  39. High 7.5

    CVE-2014-6491 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6500.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  40. Medium 5.5

    CVE-2014-6489 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect integrity and availability via vectors related to SERVER:SP.

    Published 15 Oct 2014 · Fixed in 10.0.13 · NVD
  41. High 9.3

    CVE-2014-6485 · Java

    Unspecified vulnerability in Oracle Java SE 8u20 and JavaFX 2.2.65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 15 Oct 2014 · NVD
  42. Medium 4.0

    CVE-2014-6484 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to SERVER:DML.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  43. Medium 4.3

    CVE-2014-6478 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect integrity via vectors related to SERVER:SSL:yaSSL.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  44. Medium 5.0

    CVE-2014-6476 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527.

    Published 15 Oct 2014 · NVD
  45. Low 3.5

    CVE-2014-6474 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:MEMCACHED.

    Published 15 Oct 2014 · Fixed in 10.0.13 · NVD
  46. Medium 6.8

    CVE-2014-6469 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  47. Medium 6.8

    CVE-2014-6468 · Java

    Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 15 Oct 2014 · NVD
  48. Medium 6.9

    CVE-2014-6466 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  49. Medium 4.0

    CVE-2014-6464 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  50. Low 3.3

    CVE-2014-6463 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:REPLICATION ROW FORMAT BINARY LOG DML.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.