UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
12,758
Published in 7 days
561
Critical in 30 days
124
Actively exploited
67

Latest vulnerabilities

12,758 vulnerabilities
  1. Low 2.6

    CVE-2014-6527 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476.

    Published 15 Oct 2014 · NVD
  2. Medium 4.0

    CVE-2014-6520 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:DDL.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  3. Medium 5.0

    CVE-2014-6519 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Hotspot.

    Published 15 Oct 2014 · NVD
  4. Medium 5.0

    CVE-2014-6517 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and Jrockit R27.8.3 and R28.3.3 allows remote attackers to affect confidentiality via vectors related to JAXP.

    Published 15 Oct 2014 · NVD
  5. Medium 5.0

    CVE-2014-6515 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  6. High 10.0

    CVE-2014-6513 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.

    Published 15 Oct 2014 · NVD
  7. Medium 4.3

    CVE-2014-6512 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  8. Medium 5.0

    CVE-2014-6511 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

    Published 15 Oct 2014 · NVD
  9. Medium 4.3

    CVE-2014-6507 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  10. Medium 6.8

    CVE-2014-6506 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  11. Medium 4.0

    CVE-2014-6505 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to SERVER:MEMORY STORAGE ENGINE.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  12. Medium 5.0

    CVE-2014-6504 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, and 7u67, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Hotspot.

    Published 15 Oct 2014 · NVD
  13. High 9.3

    CVE-2014-6503 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532.

    Published 15 Oct 2014 · NVD
  14. Low 2.6

    CVE-2014-6502 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries.

    Published 15 Oct 2014 · NVD
  15. High 7.5

    CVE-2014-6500 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  16. Medium 4.3

    CVE-2014-6496 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  17. Medium 4.3

    CVE-2014-6495 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect availability via vectors related to SERVER:SSL:yaSSL.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  18. Medium 4.3

    CVE-2014-6494 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  19. High 7.6

    CVE-2014-6493 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532.

    Published 15 Oct 2014 · NVD
  20. High 7.6

    CVE-2014-6492 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  21. High 7.5

    CVE-2014-6491 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6500.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  22. Medium 5.5

    CVE-2014-6489 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect integrity and availability via vectors related to SERVER:SP.

    Published 15 Oct 2014 · Fixed in 10.0.13 · NVD
  23. High 9.3

    CVE-2014-6485 · Java

    Unspecified vulnerability in Oracle Java SE 8u20 and JavaFX 2.2.65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 15 Oct 2014 · NVD
  24. Medium 4.0

    CVE-2014-6484 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to SERVER:DML.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  25. Medium 4.3

    CVE-2014-6478 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect integrity via vectors related to SERVER:SSL:yaSSL.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  26. Medium 5.0

    CVE-2014-6476 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527.

    Published 15 Oct 2014 · NVD
  27. Low 3.5

    CVE-2014-6474 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:MEMCACHED.

    Published 15 Oct 2014 · Fixed in 10.0.13 · NVD
  28. Medium 6.8

    CVE-2014-6469 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  29. Medium 6.8

    CVE-2014-6468 · Java

    Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 15 Oct 2014 · NVD
  30. Medium 6.9

    CVE-2014-6466 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  31. Medium 4.0

    CVE-2014-6464 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS.

    Published 15 Oct 2014 · Fixed in 5.5.40, 10.0.15 · NVD
  32. Low 3.3

    CVE-2014-6463 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:REPLICATION ROW FORMAT BINARY LOG DML.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  33. Medium 6.9

    CVE-2014-6458 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  34. Medium 4.0

    CVE-2014-6457 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

    Published 15 Oct 2014 · NVD
  35. High 9.3

    CVE-2014-6456 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 15 Oct 2014 · NVD
  36. High 7.6

    CVE-2014-4288 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532.

    Published 15 Oct 2014 · NVD
  37. Medium 4.0

    CVE-2014-4287 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  38. Medium 4.1

    CVE-2014-4274 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to SERVER:MyISAM.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  39. Low 3.4

    CVE-2014-3566 · OpenSSL

    The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

    Published 15 Oct 2014 · NVD
  40. Medium 5.0

    CVE-2014-3581 · Apache HTTP Server

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.

    Published 10 Oct 2014 · NVD
  41. High 7.5

    CVE-2014-7984 · Joomla!

    Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.

    Published 8 Oct 2014 · NVD
  42. Medium 4.3

    CVE-2014-7983 · Joomla!

    Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  43. Medium 4.3

    CVE-2014-7982 · Joomla!

    Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  44. High 7.5

    CVE-2014-7981 · Joomla!

    SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Published 8 Oct 2014 · NVD
  45. Medium 5.0

    CVE-2014-7229 · Joomla!

    Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors.

    Published 8 Oct 2014 · NVD
  46. High 7.5

    CVE-2014-6632 · Joomla!

    Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.

    Published 8 Oct 2014 · NVD
  47. Medium 4.3

    CVE-2014-6631 · Joomla!

    Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  48. Medium 6.4

    CVE-2014-7185 · Python

    Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.

    Published 8 Oct 2014 · NVD
  49. Low 3.5

    CVE-2014-7295 · MediaWiki

    The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.

    Published 7 Oct 2014 · NVD
  50. High 7.5

    CVE-2003-1598 · WordPress

    SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

    Published 1 Oct 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.