UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
12,758
Published in 7 days
561
Critical in 30 days
124
Actively exploited
67

Latest vulnerabilities

12,758 vulnerabilities
  1. Medium 5.0

    CVE-2014-0231 · Apache HTTP Server

    The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.

    Published 20 Jul 2014 · Fixed in 2.2.29, 2.4.10 · NVD
  2. Medium 6.8

    CVE-2014-0226 · Apache HTTP Server

    Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the…

    Published 20 Jul 2014 · Fixed in 2.2.29, 2.4.10 · NVD
  3. Medium 4.3

    CVE-2014-0118 · Apache HTTP Server

    The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

    Published 20 Jul 2014 · Fixed in 2.2.29, 2.4.10 · NVD
  4. Medium 4.3

    CVE-2014-0117 · Apache HTTP Server

    The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.

    Published 20 Jul 2014 · NVD
  5. Medium 4.3

    CVE-2013-4352 · Apache HTTP Server

    The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value.

    Published 20 Jul 2014 · NVD
  6. Medium 5.0

    CVE-2014-4268 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing.

    Published 17 Jul 2014 · NVD
  7. Medium 5.0

    CVE-2014-4266 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability.

    Published 17 Jul 2014 · NVD
  8. Medium 5.0

    CVE-2014-4265 · Java

    Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment.

    Published 17 Jul 2014 · NVD
  9. Medium 5.0

    CVE-2014-4264 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security.

    Published 17 Jul 2014 · NVD
  10. Medium 4.0

    CVE-2014-4263 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement."

    Published 17 Jul 2014 · NVD
  11. High 9.3

    CVE-2014-4262 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 17 Jul 2014 · NVD
  12. Medium 5.5

    CVE-2014-4260 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier, and 5.6.17 and earlier, allows remote authenticated users to affect integrity and availability via vectors related to SRCHAR.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  13. Medium 6.5

    CVE-2014-4258 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  14. Medium 5.0

    CVE-2014-4252 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security.

    Published 17 Jul 2014 · NVD
  15. High 9.3

    CVE-2014-4247 · Java

    Unspecified vulnerability in Oracle Java SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.

    Published 17 Jul 2014 · NVD
  16. Medium 4.0

    CVE-2014-4244 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.

    Published 17 Jul 2014 · NVD
  17. Low 2.8

    CVE-2014-4243 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to ENFED.

    Published 17 Jul 2014 · Fixed in 5.5.36, 10.0.9 · NVD
  18. Low 3.6

    CVE-2014-4240 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows local users to affect confidentiality and integrity via vectors related to SRREP.

    Published 17 Jul 2014 · NVD
  19. Medium 4.0

    CVE-2014-4238 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

    Published 17 Jul 2014 · NVD
  20. Medium 4.0

    CVE-2014-4233 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRREP.

    Published 17 Jul 2014 · NVD
  21. High 10.0

    CVE-2014-4227 · Java

    Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 17 Jul 2014 · NVD
  22. High 9.3

    CVE-2014-4223 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-2483.

    Published 17 Jul 2014 · NVD
  23. Medium 4.3

    CVE-2014-4221 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 17 Jul 2014 · NVD
  24. Medium 5.0

    CVE-2014-4220 · Java

    Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4208.

    Published 17 Jul 2014 · NVD
  25. High 9.3

    CVE-2014-4219 · Java

    Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 17 Jul 2014 · NVD
  26. Medium 5.0

    CVE-2014-4218 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries.

    Published 17 Jul 2014 · NVD
  27. High 9.3

    CVE-2014-4216 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 17 Jul 2014 · NVD
  28. Low 3.3

    CVE-2014-4214 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRSP.

    Published 17 Jul 2014 · NVD
  29. Medium 6.4

    CVE-2014-4209 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX.

    Published 17 Jul 2014 · NVD
  30. Low 2.6

    CVE-2014-4208 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4220.

    Published 17 Jul 2014 · NVD
  31. Medium 4.0

    CVE-2014-4207 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  32. Medium 4.0

    CVE-2014-2494 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  33. High 9.3

    CVE-2014-2490 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 17 Jul 2014 · NVD
  34. Medium 6.5

    CVE-2014-2484 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRFTS.

    Published 17 Jul 2014 · NVD
  35. High 9.3

    CVE-2014-2483 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the previous information is from the July 2014 CPU. Oracle has not commented on another vendor's claim that the issue is related…

    Published 17 Jul 2014 · NVD
  36. High 7.2

    CVE-2014-3499 · Docker Engine

    Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

    Published 11 Jul 2014 · NVD
  37. Medium 4.6

    CVE-2014-4698 · PHP

    Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.

    Published 10 Jul 2014 · Fixed in 5.4.32, 5.5.15 · NVD
  38. Medium 4.6

    CVE-2014-4670 · PHP

    Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.

    Published 10 Jul 2014 · NVD
  39. High 7.5

    CVE-2014-3515 · PHP

    The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  40. Medium 4.3

    CVE-2014-3487 · PHP

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  41. Medium 6.5

    CVE-2014-3480 · PHP

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  42. Medium 4.3

    CVE-2014-3479 · PHP

    The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  43. Medium 6.5

    CVE-2014-3478 · PHP

    Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

    Published 9 Jul 2014 · NVD
  44. Medium 6.5

    CVE-2014-0207 · PHP

    The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  45. Low 2.6

    CVE-2014-4721 · PHP

    The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion"…

    Published 6 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  46. Medium 5.0

    CVE-2014-3538 · PHP

    file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.

    Published 3 Jul 2014 · Fixed in 5.4.32, 5.5.16 · NVD
  47. Unrated

    CVE-2014-4664 · Wordfence Security

    Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

    Published 26 Jun 2014 · Fixed in 5.2.5 · WPVulnerability
  48. Medium 5.1

    CVE-2014-4049 · PHP

    Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.

    Published 18 Jun 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  49. Low 3.3

    CVE-2014-3981 · PHP

    acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

    Published 8 Jun 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  50. Low 2.6

    CVE-2014-3966 · MediaWiki

    Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.

    Published 6 Jun 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.