UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,932
Published in 7 days
1,035
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,932 vulnerabilities
  1. Critical 9.6

    CVE-2017-10090 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a…

    Published 8 Aug 2017 · NVD
  2. Critical 9.6

    CVE-2017-10089 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability…

    Published 8 Aug 2017 · NVD
  3. Critical 9.6

    CVE-2017-10087 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction…

    Published 8 Aug 2017 · NVD
  4. Critical 9.6

    CVE-2017-10086 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in…

    Published 8 Aug 2017 · NVD
  5. Medium 4.3

    CVE-2017-10081 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from…

    Published 8 Aug 2017 · NVD
  6. High 8.1

    CVE-2017-10078 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data…

    Published 8 Aug 2017 · NVD
  7. High 8.3

    CVE-2017-10074 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction…

    Published 8 Aug 2017 · NVD
  8. High 7.5

    CVE-2017-10067 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of…

    Published 8 Aug 2017 · NVD
  9. Medium 4.8

    CVE-2017-10063 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 8 Aug 2017 · NVD
  10. Medium 5.3

    CVE-2017-10053 · Java

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks…

    Published 8 Aug 2017 · NVD
  11. Medium 6.1

    CVE-2017-18593 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 8 Aug 2017 · Fixed in 1.13.5 · NVD, WPVulnerability
  12. Medium 6.5

    CVE-2017-12676 · ImageMagick

    In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.

    Published 7 Aug 2017 · NVD
  13. Medium 6.5

    CVE-2017-12675 · ImageMagick

    In ImageMagick 7.0.6-3, a missing check for multidimensional data was found in coders/mat.c, leading to a memory leak in the function ReadImage in MagickCore/constitute.c, which allows attackers to cause a denial of service.

    Published 7 Aug 2017 · NVD
  14. Medium 6.5

    CVE-2017-12674 · ImageMagick

    In ImageMagick 7.0.6-2, a CPU exhaustion vulnerability was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service.

    Published 7 Aug 2017 · NVD
  15. Medium 6.5

    CVE-2017-12673 · ImageMagick

    In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service.

    Published 7 Aug 2017 · NVD
  16. Medium 6.5

    CVE-2017-12672 · ImageMagick

    In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.

    Published 7 Aug 2017 · NVD
  17. Medium 6.5

    CVE-2017-12671 · ImageMagick

    In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemory in MagickCore/memory.c, which allows attackers to cause a denial of service.

    Published 7 Aug 2017 · NVD
  18. Medium 6.5

    CVE-2017-12670 · ImageMagick

    In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to an assertion failure in the function DestroyImage in MagickCore/image.c, which allows attackers to cause a denial of service.

    Published 7 Aug 2017 · NVD
  19. High 8.8

    CVE-2017-12669 · ImageMagick

    ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c.

    Published 7 Aug 2017 · NVD
  20. High 8.8

    CVE-2017-12668 · ImageMagick

    ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.

    Published 7 Aug 2017 · NVD
  21. High 8.8

    CVE-2017-12667 · ImageMagick

    ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders\mat.c.

    Published 7 Aug 2017 · NVD
  22. High 8.8

    CVE-2017-12666 · ImageMagick

    ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteINLINEImage in coders/inline.c.

    Published 7 Aug 2017 · NVD
  23. High 8.8

    CVE-2017-12665 · ImageMagick

    ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePICTImage in coders/pict.c.

    Published 7 Aug 2017 · NVD
  24. High 8.8

    CVE-2017-12664 · ImageMagick

    ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c.

    Published 7 Aug 2017 · NVD
  25. High 8.8

    CVE-2017-12663 · ImageMagick

    ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c.

    Published 7 Aug 2017 · NVD
  26. High 8.8

    CVE-2017-12662 · ImageMagick

    ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c.

    Published 7 Aug 2017 · NVD
  27. High 8.8

    CVE-2016-7976 · Ghostscript

    The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.

    Published 7 Aug 2017 · NVD
  28. High 8.8

    CVE-2014-9831 · ImageMagick

    coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file.

    Published 7 Aug 2017 · Fixed in 6.9.4-0 · NVD
  29. High 8.8

    CVE-2014-9830 · ImageMagick

    coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file.

    Published 7 Aug 2017 · Fixed in 6.9.4-0 · NVD
  30. High 8.8

    CVE-2014-9828 · ImageMagick

    coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file.

    Published 7 Aug 2017 · Fixed in 6.9.4-0 · NVD
  31. High 8.8

    CVE-2014-9827 · ImageMagick

    coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.

    Published 7 Aug 2017 · Fixed in 6.9.4-0 · NVD
  32. Medium 6.5

    CVE-2017-12654 · ImageMagick

    The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file.

    Published 7 Aug 2017 · NVD
  33. Medium 6.1

    CVE-2017-12649 · Liferay Portal / DXP

    XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.

    Published 7 Aug 2017 · NVD
  34. Medium 6.1

    CVE-2017-12648 · Liferay Portal / DXP

    XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.

    Published 7 Aug 2017 · NVD
  35. Medium 6.1

    CVE-2017-12647 · Liferay Portal / DXP

    XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.

    Published 7 Aug 2017 · NVD
  36. Medium 6.1

    CVE-2017-12646 · Liferay Portal / DXP

    XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.

    Published 7 Aug 2017 · NVD
  37. Medium 6.1

    CVE-2017-12645 · Liferay Portal / DXP

    XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

    Published 7 Aug 2017 · NVD
  38. Medium 6.1

    CVE-2016-10404 · Liferay Portal / DXP

    XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.

    Published 7 Aug 2017 · NVD
  39. High 8.8

    CVE-2017-12644 · ImageMagick

    ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c.

    Published 7 Aug 2017 · NVD
  40. Medium 6.5

    CVE-2017-12643 · ImageMagick

    ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c.

    Published 7 Aug 2017 · NVD
  41. High 8.8

    CVE-2017-12642 · ImageMagick

    ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c.

    Published 7 Aug 2017 · NVD
  42. High 8.8

    CVE-2017-12641 · ImageMagick

    ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c.

    Published 7 Aug 2017 · NVD
  43. High 8.8

    CVE-2017-12640 · ImageMagick

    ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.

    Published 7 Aug 2017 · NVD
  44. Medium 4.2

    CVE-2017-6770 · Cisco ASA and Firepower Threat Defense

    Cisco IOS 12.0 through 15.6, Adaptive Security Appliance (ASA) Software 7.0.1 through 9.7.1.2, NX-OS 4.0 through 12.0, and IOS XE 3.6 through 3.18 are affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database. This vulnerability could allow an unauthenticated, remote attacker to take full control of the OSPF Autonomous…

    Published 7 Aug 2017 · NVD
  45. Medium 6.1

    CVE-2017-6765 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device, aka WebVPN XSS. The vulnerability is due to insufficient validation of user-supplied input by the web-based…

    Published 7 Aug 2017 · NVD
  46. Medium 5.4

    CVE-2017-6764 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an…

    Published 7 Aug 2017 · NVD
  47. High 7.5

    CVE-2017-6752 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the interaction between Lightweight Directory Access Protocol (LDAP) and SSL Connection Profile when…

    Published 7 Aug 2017 · NVD
  48. Medium 5.5

    CVE-2017-6420 · ClamAV

    The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.

    Published 7 Aug 2017 · NVD
  49. Medium 5.5

    CVE-2017-6418 · ClamAV

    libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.

    Published 7 Aug 2017 · NVD
  50. High 8.8

    CVE-2017-12587 · ImageMagick

    ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.

    Published 6 Aug 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.