UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
12,757
Published in 7 days
564
Critical in 30 days
124
Actively exploited
67

Latest vulnerabilities

12,757 vulnerabilities
  1. Medium 5.0

    CVE-2014-3583 · Apache HTTP Server

    The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.

    Published 15 Dec 2014 · NVD
  2. Medium 5.0

    CVE-2014-6408 · Docker Engine

    Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.

    Published 12 Dec 2014 · NVD
  3. High 7.5

    CVE-2014-6407 · Docker Engine

    Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

    Published 12 Dec 2014 · NVD
  4. Medium 5.8

    CVE-2014-9365 · Python

    The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows…

    Published 12 Dec 2014 · NVD
  5. Medium 4.3

    CVE-2014-3616 · nginx

    nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

    Published 8 Dec 2014 · Fixed in 1.6.2, 1.7.5 · NVD
  6. High 7.5

    CVE-2014-1693 · Erlang/OTP

    Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17)…

    Published 8 Dec 2014 · NVD
  7. Medium 6.1

    CVE-2014-4932 · Wordfence Security

    Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

    Published 8 Dec 2014 · Fixed in 5.1.5 · NVD, WPVulnerability
  8. Unrated

    WPV-142c04a3f0ff · Slider Revolution

    Vulnerability in Slider Revolution

    Published 26 Nov 2014 · Fixed in 3.0.96 · WPVulnerability
  9. Medium 4.3

    CVE-2014-9039 · WordPress

    wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

    Published 25 Nov 2014 · NVD
  10. Medium 6.4

    CVE-2014-9038 · WordPress

    wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.

    Published 25 Nov 2014 · NVD
  11. Medium 6.8

    CVE-2014-9037 · WordPress

    WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.

    Published 25 Nov 2014 · NVD
  12. Medium 4.3

    CVE-2014-9036 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.

    Published 25 Nov 2014 · NVD
  13. Medium 4.3

    CVE-2014-9035 · WordPress

    Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 25 Nov 2014 · NVD
  14. Medium 5.0

    CVE-2014-9034 · WordPress

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.

    Published 25 Nov 2014 · NVD
  15. Medium 6.8

    CVE-2014-9033 · WordPress

    Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.

    Published 25 Nov 2014 · NVD
  16. Medium 4.3

    CVE-2014-9032 · WordPress

    Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 25 Nov 2014 · NVD
  17. Medium 4.3

    CVE-2014-9031 · WordPress

    Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.

    Published 25 Nov 2014 · NVD
  18. High 7.5

    CVE-2014-9735 · Slider Revolution

    Vulnerability in Slider Revolution

    Published 25 Nov 2014 · Fixed in 3.0.96 · NVD, WPVulnerability
  19. High 7.5

    CVE-2014-8626 · PHP

    Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

    Published 23 Nov 2014 · NVD
  20. Medium 5.0

    CVE-2014-8090 · Ruby

    The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists…

    Published 21 Nov 2014 · NVD
  21. Medium 5.0

    CVE-2014-3620 · curl

    cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.

    Published 18 Nov 2014 · NVD
  22. Medium 5.0

    CVE-2014-3613 · curl

    cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.

    Published 18 Nov 2014 · NVD
  23. Medium 5.0

    CVE-2014-5277 · Docker Engine

    Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.

    Published 17 Nov 2014 · NVD
  24. Low 3.3

    CVE-2014-2667 · Python

    Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

    Published 16 Nov 2014 · NVD
  25. Medium 5.0

    CVE-2014-4975 · Ruby

    Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

    Published 15 Nov 2014 · NVD
  26. Medium 4.3

    CVE-2014-3707 · curl

    The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.

    Published 15 Nov 2014 · NVD
  27. Medium 5.1

    CVE-2014-4078 · Microsoft IIS

    The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka "IIS Security Feature Bypass Vulnerability."

    Published 11 Nov 2014 · NVD
  28. Unrated

    CVE-2014-8724 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 10 Nov 2014 · Fixed in 0.9.4.1 · WPVulnerability
  29. Medium 5.0

    CVE-2014-3710 · PHP

    The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

    Published 5 Nov 2014 · Fixed in 5.4.35, 5.5.19, 5.6.3 · NVD
  30. High 7.5

    CVE-2014-7228 · Joomla!

    Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an…

    Published 3 Nov 2014 · NVD
  31. Medium 5.0

    CVE-2014-8080 · Ruby

    The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

    Published 3 Nov 2014 · NVD
  32. Medium 6.8

    CVE-2014-3670 · PHP

    The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by…

    Published 29 Oct 2014 · NVD
  33. High 7.5

    CVE-2014-3669 · PHP

    Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.

    Published 29 Oct 2014 · NVD
  34. Medium 5.0

    CVE-2014-3668 · PHP

    Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument to the xmlrpc_set_type function or (2) a crafted argument to the xmlrpc_decode function, related to…

    Published 29 Oct 2014 · NVD
  35. High 7.5

    CVE-2003-1599 · WordPress

    PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable.

    Published 27 Oct 2014 · NVD
  36. Medium 4.3

    CVE-2012-2413 · Joomla!

    Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

    Published 20 Oct 2014 · NVD
  37. Medium 5.0

    CVE-2014-7191 · Node.js

    The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

    Published 19 Oct 2014 · NVD
  38. Medium 4.3

    CVE-2014-3568 · OpenSSL

    OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.

    Published 19 Oct 2014 · NVD
  39. High 7.1

    CVE-2014-3567 · OpenSSL

    Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.

    Published 19 Oct 2014 · NVD
  40. High 7.1

    CVE-2014-3513 · OpenSSL

    Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.

    Published 19 Oct 2014 · NVD
  41. Medium 4.0

    CVE-2014-6564 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB FULLTEXT SEARCH DML.

    Published 15 Oct 2014 · Fixed in 10.0.13 · NVD
  42. High 9.3

    CVE-2014-6562 · Java

    Unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  43. Medium 4.3

    CVE-2014-6559 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  44. Low 2.6

    CVE-2014-6558 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.

    Published 15 Oct 2014 · NVD
  45. Medium 6.5

    CVE-2014-6555 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  46. Low 2.1

    CVE-2014-6551 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality via vectors related to CLIENT:MYSQLADMIN.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  47. High 9.3

    CVE-2014-6532 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503.

    Published 15 Oct 2014 · NVD
  48. Medium 4.3

    CVE-2014-6531 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  49. Medium 6.5

    CVE-2014-6530 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to CLIENT:MYSQLDUMP.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  50. Low 2.6

    CVE-2014-6527 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476.

    Published 15 Oct 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.