UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,525
Published in 7 days
366
Critical in 30 days
105
Actively exploited
66

Latest vulnerabilities

11,525 vulnerabilities
  1. Medium 4.3

    CVE-2014-3508 · OpenSSL

    The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other…

    Published 13 Aug 2014 · NVD
  2. Medium 5.0

    CVE-2014-3507 · OpenSSL

    Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

    Published 13 Aug 2014 · NVD
  3. Medium 5.0

    CVE-2014-3506 · OpenSSL

    d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

    Published 13 Aug 2014 · NVD
  4. Medium 5.0

    CVE-2014-3505 · OpenSSL

    Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

    Published 13 Aug 2014 · NVD
  5. Unrated

    WPV-f3fc02351c8c · Gtranslate (WordPress plugin)

    Vulnerability in Translate WordPress with GTranslate

    Published 1 Aug 2014 · Fixed in 1.0.13 · WPVulnerability
  6. Unrated

    WPV-ba50a8a61674 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 1 Aug 2014 · Fixed in 3.8.3 · WPVulnerability
  7. Unrated

    WPV-9d84ac5c78b3 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 1 Aug 2014 · Fixed in 3.5.3 · WPVulnerability
  8. Unrated

    WPV-381339795444 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 1 Aug 2014 · Fixed in 3.5.3 · WPVulnerability
  9. Unrated

    WPV-16e7168763e1 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 1 Aug 2014 · Fixed in 1.4.7 · WPVulnerability
  10. High 8.8

    CVE-2014-2550 · Disable Comments (WordPress plugin)

    Disable Comments – Remove Comments & Stop Spam [Multi-Site Support]: Cross-Site Request Forgery (CSRF)

    Published 1 Aug 2014 · Fixed in 1.0.4 · WPVulnerability
  11. Medium 6.1

    CVE-2013-5988 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 2.0.3.1 · NVD, WPVulnerability
  12. High 8.8

    CVE-2013-2011 · WP Super Cache (WordPress plugin)

    WP Super Cache: Improper Encoding or Escaping of Output

    Published 1 Aug 2014 · Fixed in 1.3.2 · WPVulnerability
  13. Critical 9.8

    CVE-2013-2010 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Injection

    Published 1 Aug 2014 · Fixed in 0.9.2.9 · WPVulnerability
  14. High 8.8

    CVE-2013-2009 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 1 Aug 2014 · Fixed in 1.3.2 · WPVulnerability
  15. Medium 6.1

    CVE-2013-2008 · WP Super Cache (WordPress plugin)

    WP Super Cache: Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 1.3.1 · WPVulnerability
  16. Medium 6.1

    CVE-2011-5329 · Redirection (WordPress plugin)

    Redirection: Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 2.2.9 · WPVulnerability
  17. High 8.1Actively exploited

    CVE-2014-3120 · Elasticsearch

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

    Published 28 Jul 2014 · Fixed in 1.2.0 · NVD
  18. Medium 5.0

    CVE-2014-3523 · Apache HTTP Server

    Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.

    Published 20 Jul 2014 · NVD
  19. Medium 5.0

    CVE-2014-0231 · Apache HTTP Server

    The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.

    Published 20 Jul 2014 · Fixed in 2.2.29, 2.4.10 · NVD
  20. Medium 6.8

    CVE-2014-0226 · Apache HTTP Server

    Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the…

    Published 20 Jul 2014 · Fixed in 2.2.29, 2.4.10 · NVD
  21. Medium 4.3

    CVE-2014-0118 · Apache HTTP Server

    The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

    Published 20 Jul 2014 · Fixed in 2.2.29, 2.4.10 · NVD
  22. Medium 4.3

    CVE-2014-0117 · Apache HTTP Server

    The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.

    Published 20 Jul 2014 · NVD
  23. Medium 4.3

    CVE-2013-4352 · Apache HTTP Server

    The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value.

    Published 20 Jul 2014 · NVD
  24. Medium 5.0

    CVE-2014-4268 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing.

    Published 17 Jul 2014 · NVD
  25. Medium 5.0

    CVE-2014-4266 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability.

    Published 17 Jul 2014 · NVD
  26. Medium 5.0

    CVE-2014-4265 · Java

    Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment.

    Published 17 Jul 2014 · NVD
  27. Medium 5.0

    CVE-2014-4264 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security.

    Published 17 Jul 2014 · NVD
  28. Medium 4.0

    CVE-2014-4263 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement."

    Published 17 Jul 2014 · NVD
  29. High 9.3

    CVE-2014-4262 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 17 Jul 2014 · NVD
  30. Medium 5.5

    CVE-2014-4260 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier, and 5.6.17 and earlier, allows remote authenticated users to affect integrity and availability via vectors related to SRCHAR.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  31. Medium 6.5

    CVE-2014-4258 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  32. Medium 5.0

    CVE-2014-4252 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security.

    Published 17 Jul 2014 · NVD
  33. High 9.3

    CVE-2014-4247 · Java

    Unspecified vulnerability in Oracle Java SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.

    Published 17 Jul 2014 · NVD
  34. Medium 4.0

    CVE-2014-4244 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.

    Published 17 Jul 2014 · NVD
  35. Low 2.8

    CVE-2014-4243 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to ENFED.

    Published 17 Jul 2014 · Fixed in 5.5.36, 10.0.9 · NVD
  36. Low 3.6

    CVE-2014-4240 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows local users to affect confidentiality and integrity via vectors related to SRREP.

    Published 17 Jul 2014 · NVD
  37. Medium 4.0

    CVE-2014-4238 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

    Published 17 Jul 2014 · NVD
  38. Medium 4.0

    CVE-2014-4233 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRREP.

    Published 17 Jul 2014 · NVD
  39. High 10.0

    CVE-2014-4227 · Java

    Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 17 Jul 2014 · NVD
  40. High 9.3

    CVE-2014-4223 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-2483.

    Published 17 Jul 2014 · NVD
  41. Medium 4.3

    CVE-2014-4221 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 17 Jul 2014 · NVD
  42. Medium 5.0

    CVE-2014-4220 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4208.

    Published 17 Jul 2014 · NVD
  43. High 9.3

    CVE-2014-4219 · Java

    Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 17 Jul 2014 · NVD
  44. Medium 5.0

    CVE-2014-4218 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries.

    Published 17 Jul 2014 · NVD
  45. High 9.3

    CVE-2014-4216 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 17 Jul 2014 · NVD
  46. Low 3.3

    CVE-2014-4214 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRSP.

    Published 17 Jul 2014 · NVD
  47. Medium 6.4

    CVE-2014-4209 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX.

    Published 17 Jul 2014 · NVD
  48. Low 2.6

    CVE-2014-4208 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4220.

    Published 17 Jul 2014 · NVD
  49. Medium 4.0

    CVE-2014-4207 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  50. Medium 4.0

    CVE-2014-2494 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.