UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
12,672
Published in 7 days
498
Critical in 30 days
118
Actively exploited
67

Latest vulnerabilities

12,672 vulnerabilities
  1. Medium 5.0

    CVE-2015-3153 · curl

    The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

    Published 1 May 2015 · NVD
  2. Medium 6.5

    CVE-2015-3458 · Magento / Adobe Commerce

    The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue…

    Published 29 Apr 2015 · NVD
  3. Medium 5.0

    CVE-2015-3457 · Magento / Adobe Commerce

    Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.

    Published 29 Apr 2015 · NVD
  4. Medium 6.5

    CVE-2015-1399 · Magento / Adobe Commerce

    PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since…

    Published 29 Apr 2015 · NVD
  5. Medium 6.5

    CVE-2015-1398 · Magento / Adobe Commerce

    Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the…

    Published 29 Apr 2015 · NVD
  6. Medium 6.5

    CVE-2015-1397 · Magento / Adobe Commerce

    SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.

    Published 29 Apr 2015 · NVD
  7. High 7.5

    CVE-2015-3416 · PHP

    The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

    Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD
  8. High 7.5

    CVE-2015-3415 · PHP

    The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

    Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD
  9. High 7.5

    CVE-2015-3414 · PHP

    SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

    Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD
  10. Medium 5.0

    CVE-2015-3148 · curl

    cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.

    Published 24 Apr 2015 · NVD
  11. High 7.5

    CVE-2015-3145 · curl

    The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

    Published 24 Apr 2015 · NVD
  12. High 9.0

    CVE-2015-3144 · curl

    The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

    Published 24 Apr 2015 · NVD
  13. Medium 5.0

    CVE-2015-3143 · curl

    cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.

    Published 24 Apr 2015 · NVD
  14. Unrated

    WPV-f967e51cbb1c · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 20 Apr 2015 · Fixed in 2.2.6.2 · WPVulnerability
  15. Unrated

    WPV-e79447e47a65 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
  16. Unrated

    WPV-98fe49343dfe · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 20 Apr 2015 · Fixed in 1.9.6.4 · WPVulnerability
  17. Unrated

    WPV-92afc7a45f4d · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 20 Apr 2015 · Fixed in 1.9.6.4 · WPVulnerability
  18. Unrated

    WPV-64ab3d07f7dd · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 20 Apr 2015 · Fixed in 3.4.3 · WPVulnerability
  19. Unrated

    WPV-2f093ee917a5 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
  20. Medium 6.1

    CVE-2015-9359 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 20 Apr 2015 · Fixed in 3.4.3 · NVD, WPVulnerability
  21. Low 2.1

    CVE-2015-2576 · MySQL

    Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.

    Published 16 Apr 2015 · NVD
  22. Medium 4.0

    CVE-2015-2573 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  23. Medium 4.0

    CVE-2015-2571 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  24. Medium 5.0

    CVE-2015-2568 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  25. Low 3.5

    CVE-2015-2567 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 16 Apr 2015 · NVD
  26. Low 2.8

    CVE-2015-2566 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 16 Apr 2015 · NVD
  27. Low 2.8

    CVE-2015-0511 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP.

    Published 16 Apr 2015 · NVD
  28. Medium 4.0

    CVE-2015-0508 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.

    Published 16 Apr 2015 · NVD
  29. Low 3.5

    CVE-2015-0507 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

    Published 16 Apr 2015 · NVD
  30. Low 3.5

    CVE-2015-0506 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2015-0508.

    Published 16 Apr 2015 · NVD
  31. Low 3.5

    CVE-2015-0505 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  32. Medium 4.0

    CVE-2015-0503 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.

    Published 16 Apr 2015 · NVD
  33. Medium 5.7

    CVE-2015-0501 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  34. Medium 4.0

    CVE-2015-0500 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors.

    Published 16 Apr 2015 · NVD
  35. Low 3.5

    CVE-2015-0499 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  36. Low 1.7

    CVE-2015-0498 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.

    Published 16 Apr 2015 · NVD
  37. High 9.3

    CVE-2015-0492 · Java

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.

    Published 16 Apr 2015 · NVD
  38. High 10.0

    CVE-2015-0491 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459.

    Published 16 Apr 2015 · NVD
  39. Medium 5.0

    CVE-2015-0488 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.

    Published 16 Apr 2015 · NVD
  40. Medium 5.0

    CVE-2015-0486 · Java

    Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

    Published 16 Apr 2015 · NVD
  41. Medium 6.8

    CVE-2015-0484 · Java

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0492.

    Published 16 Apr 2015 · NVD
  42. Medium 5.8

    CVE-2015-0480 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

    Published 16 Apr 2015 · NVD
  43. Medium 4.3

    CVE-2015-0478 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE.

    Published 16 Apr 2015 · NVD
  44. Medium 4.3

    CVE-2015-0477 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.

    Published 16 Apr 2015 · NVD
  45. Medium 4.3

    CVE-2015-0470 · Java

    Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot.

    Published 16 Apr 2015 · NVD
  46. High 10.0

    CVE-2015-0469 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 16 Apr 2015 · NVD
  47. High 9.3

    CVE-2015-0460 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 16 Apr 2015 · NVD
  48. High 10.0

    CVE-2015-0459 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491.

    Published 16 Apr 2015 · NVD
  49. High 7.6

    CVE-2015-0458 · Java

    Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 16 Apr 2015 · NVD
  50. Medium 4.0

    CVE-2015-0441 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.