UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
12,757
Published in 7 days
565
Critical in 30 days
124
Actively exploited
67

Latest vulnerabilities

12,757 vulnerabilities
  1. High 10.0

    CVE-2015-0408 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.

    Published 21 Jan 2015 · NVD
  2. Medium 5.0

    CVE-2015-0407 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.

    Published 21 Jan 2015 · NVD
  3. Medium 5.8

    CVE-2015-0406 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.

    Published 21 Jan 2015 · NVD
  4. Medium 6.9

    CVE-2015-0403 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 21 Jan 2015 · NVD
  5. Medium 5.0

    CVE-2015-0400 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 21 Jan 2015 · NVD
  6. High 9.3

    CVE-2015-0395 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  7. Medium 4.0

    CVE-2015-0391 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 21 Jan 2015 · Fixed in 5.5.39, 10.0.13 · NVD
  8. Low 3.5

    CVE-2015-0385 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth.

    Published 21 Jan 2015 · NVD
  9. Medium 5.4

    CVE-2015-0383 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  10. Medium 4.3

    CVE-2015-0382 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  11. Medium 4.3

    CVE-2015-0381 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  12. Low 3.5

    CVE-2015-0374 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  13. High 10.0

    CVE-2014-6601 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  14. Medium 4.0

    CVE-2014-6593 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

    Published 21 Jan 2015 · NVD
  15. Low 2.6

    CVE-2014-6591 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585.

    Published 21 Jan 2015 · NVD
  16. Medium 4.3

    CVE-2014-6587 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 21 Jan 2015 · NVD
  17. Low 2.6

    CVE-2014-6585 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.

    Published 21 Jan 2015 · NVD
  18. Low 3.5

    CVE-2014-6568 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  19. High 10.0

    CVE-2014-6549 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 21 Jan 2015 · NVD
  20. Medium 4.3

    CVE-2014-9480 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts.

    Published 16 Jan 2015 · NVD
  21. Medium 4.3

    CVE-2014-9479 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox.

    Published 16 Jan 2015 · NVD
  22. Low 2.6

    CVE-2014-9478 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.

    Published 16 Jan 2015 · NVD
  23. Medium 4.3

    CVE-2014-9477 · MediaWiki

    Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter.

    Published 16 Jan 2015 · NVD
  24. Medium 5.0

    CVE-2014-9476 · MediaWiki

    MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/."

    Published 16 Jan 2015 · NVD
  25. Low 3.5

    CVE-2014-9475 · MediaWiki

    Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.

    Published 16 Jan 2015 · NVD
  26. Medium 5.8

    CVE-2014-8151 · curl

    The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

    Published 15 Jan 2015 · NVD
  27. Medium 4.3

    CVE-2014-8150 · curl

    CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

    Published 15 Jan 2015 · NVD
  28. Medium 5.0

    CVE-2015-0206 · OpenSSL

    Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.

    Published 9 Jan 2015 · NVD
  29. Medium 5.0

    CVE-2015-0205 · OpenSSL

    The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority…

    Published 9 Jan 2015 · NVD
  30. Medium 4.3

    CVE-2015-0204 · OpenSSL

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not…

    Published 9 Jan 2015 · NVD
  31. Medium 5.0

    CVE-2014-8275 · OpenSSL

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and…

    Published 9 Jan 2015 · NVD
  32. Medium 5.0

    CVE-2014-3572 · OpenSSL

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

    Published 9 Jan 2015 · NVD
  33. Medium 5.0

    CVE-2014-3571 · OpenSSL

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.

    Published 9 Jan 2015 · NVD
  34. Medium 5.0

    CVE-2014-3570 · OpenSSL

    The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.

    Published 9 Jan 2015 · NVD
  35. Unrated

    CVE-2015-0902 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Exposure of Sensitive Information to an Unauthorized Actor

    Published 8 Jan 2015 · Fixed in 2.2.6 · WPVulnerability
  36. Low 2.6

    CVE-2014-9507 · MediaWiki

    MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.

    Published 4 Jan 2015 · NVD
  37. High 7.5

    CVE-2014-9277 · MediaWiki

    The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.

    Published 4 Jan 2015 · NVD
  38. Medium 5.1

    CVE-2014-9276 · MediaWiki

    Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly…

    Published 4 Jan 2015 · NVD
  39. High 7.5

    CVE-2014-9427 · PHP

    sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive…

    Published 3 Jan 2015 · NVD
  40. High 7.3

    CVE-2014-9426 · PHP

    The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard…

    Published 31 Dec 2014 · NVD
  41. High 7.5

    CVE-2014-9425 · PHP

    Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

    Published 31 Dec 2014 · NVD
  42. Medium 4.3

    CVE-2014-8109 · Apache HTTP Server

    mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a…

    Published 29 Dec 2014 · NVD
  43. Medium 6.8

    CVE-2014-3556 · nginx

    The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a…

    Published 29 Dec 2014 · Fixed in 1.6.1, 1.7.4 · NVD
  44. Medium 5.0

    CVE-2014-3971 · MongoDB

    The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

    Published 25 Dec 2014 · NVD
  45. Medium 5.0

    CVE-2014-3569 · OpenSSL

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue…

    Published 24 Dec 2014 · NVD
  46. High 7.5

    CVE-2014-8142 · PHP

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

    Published 20 Dec 2014 · NVD
  47. Medium 4.3

    CVE-2015-5151 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 17 Dec 2014 · Fixed in 4.2.3 · NVD, WPVulnerability
  48. Medium 6.4

    CVE-2014-9358 · Docker Engine

    Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

    Published 16 Dec 2014 · NVD
  49. High 10.0

    CVE-2014-9357 · Docker Engine

    Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

    Published 16 Dec 2014 · NVD
  50. Medium 5.0

    CVE-2014-8964 · MariaDB

    Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.

    Published 16 Dec 2014 · Fixed in 10.0.18 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.