UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
12,758
Published in 7 days
561
Critical in 30 days
124
Actively exploited
67

Latest vulnerabilities

12,758 vulnerabilities
  1. Medium 4.3

    CVE-2014-7199 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

    Published 30 Sept 2014 · NVD
  2. Medium 5.0

    CVE-2014-6269 · HAProxy

    Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.

    Published 30 Sept 2014 · NVD
  3. Low 3.6

    CVE-2014-5459 · PHP

    The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

    Published 27 Sept 2014 · NVD
  4. Unrated

    WPV-a42708036391 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 27 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  5. Unrated

    WPV-6db3665fc02c · WooCommerce

    Vulnerability in WooCommerce

    Published 17 Sept 2014 · Fixed in 2.2.3 · WPVulnerability
  6. Unrated

    WPV-efc6f73c236e · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  7. Unrated

    WPV-17ae3c8f844e · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  8. Unrated

    WPV-1582a518b430 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · WPVulnerability
  9. Medium 6.8

    CVE-2013-4444 · Apache Tomcat

    Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

    Published 12 Sept 2014 · NVD
  10. Unrated

    CVE-2014-6313 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 11 Sept 2014 · Fixed in 2.2.3 · WPVulnerability
  11. Unrated

    WPV-f7cb5238e39a · Tinymce Advanced (WordPress plugin)

    Vulnerability in Advanced Editor Tools

    Published 8 Sept 2014 · Fixed in 4.2.3 · WPVulnerability
  12. Unrated

    WPV-e5cf784f120b · Tinymce Advanced (WordPress plugin)

    Vulnerability in Advanced Editor Tools

    Published 8 Sept 2014 · Fixed in 4.2.3 · WPVulnerability
  13. Unrated

    WPV-6bcef03e168a · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 8 Sept 2014 · Fixed in 0.9.4.1 · WPVulnerability
  14. Unrated

    WPV-15a602cc6df2 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 8 Sept 2014 · Fixed in 5.2.3 · WPVulnerability
  15. Unrated

    CVE-2014-9414 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-Site Request Forgery (CSRF)

    Published 8 Sept 2014 · Fixed in 0.9.4.1 · WPVulnerability
  16. Medium 6.4

    CVE-2014-5120 · PHP

    gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

    Published 23 Aug 2014 · NVD
  17. Medium 6.8

    CVE-2014-3597 · PHP

    Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.

    Published 23 Aug 2014 · NVD
  18. Medium 4.3

    CVE-2014-3587 · PHP

    Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.

    Published 23 Aug 2014 · NVD
  19. Medium 4.3

    CVE-2014-5243 · MediaWiki

    MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

    Published 22 Aug 2014 · NVD
  20. Medium 4.3

    CVE-2014-5242 · MediaWiki

    Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.

    Published 22 Aug 2014 · NVD
  21. Medium 6.8

    CVE-2014-5241 · MediaWiki

    The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF…

    Published 22 Aug 2014 · NVD
  22. Medium 5.0

    CVE-2014-5266 · WordPress

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.

    Published 18 Aug 2014 · NVD
  23. Medium 5.0

    CVE-2014-5265 · WordPress

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to…

    Published 18 Aug 2014 · NVD
  24. Low 2.1

    CVE-2014-5240 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

    Published 18 Aug 2014 · NVD
  25. Medium 6.8

    CVE-2014-5205 · WordPress

    wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

    Published 18 Aug 2014 · NVD
  26. Medium 6.8

    CVE-2014-5204 · WordPress

    wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

    Published 18 Aug 2014 · NVD
  27. High 7.5

    CVE-2014-5203 · WordPress

    wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.

    Published 18 Aug 2014 · NVD
  28. Medium 4.3

    CVE-2014-5139 · OpenSSL

    The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

    Published 13 Aug 2014 · NVD
  29. High 7.5

    CVE-2014-3512 · OpenSSL

    Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

    Published 13 Aug 2014 · NVD
  30. Medium 4.3

    CVE-2014-3511 · OpenSSL

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.

    Published 13 Aug 2014 · NVD
  31. Medium 4.3

    CVE-2014-3510 · OpenSSL

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

    Published 13 Aug 2014 · NVD
  32. Medium 6.8

    CVE-2014-3509 · OpenSSL

    Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

    Published 13 Aug 2014 · NVD
  33. Medium 4.3

    CVE-2014-3508 · OpenSSL

    The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other…

    Published 13 Aug 2014 · NVD
  34. Medium 5.0

    CVE-2014-3507 · OpenSSL

    Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

    Published 13 Aug 2014 · NVD
  35. Medium 5.0

    CVE-2014-3506 · OpenSSL

    d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

    Published 13 Aug 2014 · NVD
  36. Medium 5.0

    CVE-2014-3505 · OpenSSL

    Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

    Published 13 Aug 2014 · NVD
  37. Unrated

    WPV-f3fc02351c8c · Gtranslate (WordPress plugin)

    Vulnerability in Translate WordPress with GTranslate

    Published 1 Aug 2014 · Fixed in 1.0.13 · WPVulnerability
  38. Unrated

    WPV-ba50a8a61674 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 1 Aug 2014 · Fixed in 3.8.3 · WPVulnerability
  39. Unrated

    WPV-9d84ac5c78b3 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 1 Aug 2014 · Fixed in 3.5.3 · WPVulnerability
  40. Unrated

    WPV-381339795444 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 1 Aug 2014 · Fixed in 3.5.3 · WPVulnerability
  41. Unrated

    WPV-16e7168763e1 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 1 Aug 2014 · Fixed in 1.4.7 · WPVulnerability
  42. High 8.8

    CVE-2014-2550 · Disable Comments (WordPress plugin)

    Disable Comments – Remove Comments & Stop Spam [Multi-Site Support]: Cross-Site Request Forgery (CSRF)

    Published 1 Aug 2014 · Fixed in 1.0.4 · WPVulnerability
  43. Medium 6.1

    CVE-2013-5988 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 2.0.3.1 · NVD, WPVulnerability
  44. High 8.8

    CVE-2013-2011 · WP Super Cache (WordPress plugin)

    WP Super Cache: Improper Encoding or Escaping of Output

    Published 1 Aug 2014 · Fixed in 1.3.2 · WPVulnerability
  45. Critical 9.8

    CVE-2013-2010 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Injection

    Published 1 Aug 2014 · Fixed in 0.9.2.9 · WPVulnerability
  46. High 8.8

    CVE-2013-2009 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 1 Aug 2014 · Fixed in 1.3.2 · WPVulnerability
  47. Medium 6.1

    CVE-2013-2008 · WP Super Cache (WordPress plugin)

    WP Super Cache: Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 1.3.1 · WPVulnerability
  48. Medium 6.1

    CVE-2011-5329 · Redirection (WordPress plugin)

    Redirection: Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 2.2.9 · WPVulnerability
  49. High 8.1Actively exploited

    CVE-2014-3120 · Elasticsearch

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

    Published 28 Jul 2014 · Fixed in 1.2.0 · NVD
  50. Medium 5.0

    CVE-2014-3523 · Apache HTTP Server

    Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.

    Published 20 Jul 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.