UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,525
Published in 7 days
366
Critical in 30 days
105
Actively exploited
66

Latest vulnerabilities

11,525 vulnerabilities
  1. Medium 6.9

    CVE-2014-6458 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  2. Medium 4.0

    CVE-2014-6457 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

    Published 15 Oct 2014 · NVD
  3. High 9.3

    CVE-2014-6456 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 15 Oct 2014 · NVD
  4. High 7.6

    CVE-2014-4288 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532.

    Published 15 Oct 2014 · NVD
  5. Medium 4.0

    CVE-2014-4287 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  6. Medium 4.1

    CVE-2014-4274 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to SERVER:MyISAM.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  7. Low 3.4

    CVE-2014-3566 · OpenSSL

    The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

    Published 15 Oct 2014 · NVD
  8. Medium 5.0

    CVE-2014-3581 · Apache HTTP Server

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.

    Published 10 Oct 2014 · NVD
  9. High 7.5

    CVE-2014-7984 · Joomla!

    Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.

    Published 8 Oct 2014 · NVD
  10. Medium 4.3

    CVE-2014-7983 · Joomla!

    Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  11. Medium 4.3

    CVE-2014-7982 · Joomla!

    Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  12. High 7.5

    CVE-2014-7981 · Joomla!

    SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Published 8 Oct 2014 · NVD
  13. Medium 5.0

    CVE-2014-7229 · Joomla!

    Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors.

    Published 8 Oct 2014 · NVD
  14. High 7.5

    CVE-2014-6632 · Joomla!

    Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.

    Published 8 Oct 2014 · NVD
  15. Medium 4.3

    CVE-2014-6631 · Joomla!

    Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  16. Medium 6.4

    CVE-2014-7185 · Python

    Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.

    Published 8 Oct 2014 · NVD
  17. Low 3.5

    CVE-2014-7295 · MediaWiki

    The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.

    Published 7 Oct 2014 · NVD
  18. High 7.5

    CVE-2003-1598 · WordPress

    SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

    Published 1 Oct 2014 · NVD
  19. Medium 4.3

    CVE-2014-7199 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

    Published 30 Sept 2014 · NVD
  20. Medium 5.0

    CVE-2014-6269 · HAProxy

    Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.

    Published 30 Sept 2014 · NVD
  21. Low 3.6

    CVE-2014-5459 · PHP

    The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

    Published 27 Sept 2014 · NVD
  22. Unrated

    WPV-a42708036391 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 27 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  23. Unrated

    WPV-6db3665fc02c · WooCommerce

    Vulnerability in WooCommerce

    Published 17 Sept 2014 · Fixed in 2.2.3 · WPVulnerability
  24. Unrated

    WPV-efc6f73c236e · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  25. Unrated

    WPV-17ae3c8f844e · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  26. Unrated

    WPV-1582a518b430 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · WPVulnerability
  27. Medium 6.8

    CVE-2013-4444 · Apache Tomcat

    Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

    Published 12 Sept 2014 · NVD
  28. Unrated

    CVE-2014-6313 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 11 Sept 2014 · Fixed in 2.2.3 · WPVulnerability
  29. Unrated

    WPV-f7cb5238e39a · Tinymce Advanced (WordPress plugin)

    Vulnerability in Advanced Editor Tools

    Published 8 Sept 2014 · Fixed in 4.2.3 · WPVulnerability
  30. Unrated

    WPV-e5cf784f120b · Tinymce Advanced (WordPress plugin)

    Vulnerability in Advanced Editor Tools

    Published 8 Sept 2014 · Fixed in 4.2.3 · WPVulnerability
  31. Unrated

    WPV-6bcef03e168a · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 8 Sept 2014 · Fixed in 0.9.4.1 · WPVulnerability
  32. Unrated

    WPV-15a602cc6df2 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 8 Sept 2014 · Fixed in 5.2.3 · WPVulnerability
  33. Unrated

    CVE-2014-9414 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-Site Request Forgery (CSRF)

    Published 8 Sept 2014 · Fixed in 0.9.4.1 · WPVulnerability
  34. Medium 6.4

    CVE-2014-5120 · PHP

    gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

    Published 23 Aug 2014 · NVD
  35. Medium 6.8

    CVE-2014-3597 · PHP

    Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.

    Published 23 Aug 2014 · NVD
  36. Medium 4.3

    CVE-2014-3587 · PHP

    Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.

    Published 23 Aug 2014 · NVD
  37. Medium 4.3

    CVE-2014-5243 · MediaWiki

    MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

    Published 22 Aug 2014 · NVD
  38. Medium 4.3

    CVE-2014-5242 · MediaWiki

    Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.

    Published 22 Aug 2014 · NVD
  39. Medium 6.8

    CVE-2014-5241 · MediaWiki

    The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF…

    Published 22 Aug 2014 · NVD
  40. Medium 5.0

    CVE-2014-5266 · WordPress

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.

    Published 18 Aug 2014 · NVD
  41. Medium 5.0

    CVE-2014-5265 · WordPress

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to…

    Published 18 Aug 2014 · NVD
  42. Low 2.1

    CVE-2014-5240 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

    Published 18 Aug 2014 · NVD
  43. Medium 6.8

    CVE-2014-5205 · WordPress

    wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

    Published 18 Aug 2014 · NVD
  44. Medium 6.8

    CVE-2014-5204 · WordPress

    wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

    Published 18 Aug 2014 · NVD
  45. High 7.5

    CVE-2014-5203 · WordPress

    wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.

    Published 18 Aug 2014 · NVD
  46. Medium 4.3

    CVE-2014-5139 · OpenSSL

    The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

    Published 13 Aug 2014 · NVD
  47. High 7.5

    CVE-2014-3512 · OpenSSL

    Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

    Published 13 Aug 2014 · NVD
  48. Medium 4.3

    CVE-2014-3511 · OpenSSL

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.

    Published 13 Aug 2014 · NVD
  49. Medium 4.3

    CVE-2014-3510 · OpenSSL

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

    Published 13 Aug 2014 · NVD
  50. Medium 6.8

    CVE-2014-3509 · OpenSSL

    Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

    Published 13 Aug 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.