UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,932
Published in 7 days
1,027
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,932 vulnerabilities
  1. Medium 6.5

    CVE-2017-3331 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). The supported version that is affected is 5.7.11 to 5.7.17. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 24 Apr 2017 · NVD
  2. High 7.5

    CVE-2017-3329 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Thread Pooling). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 24 Apr 2017 · NVD
  3. High 7.7

    CVE-2017-3309 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may…

    Published 24 Apr 2017 · Fixed in 10.0.31, 10.1.23, 10.2.6 · NVD
  4. High 7.7

    CVE-2017-3308 · MariaDB, MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may…

    Published 24 Apr 2017 · Fixed in 10.0.31, 10.1.23, 10.2.6 · NVD
  5. Medium 5.3

    CVE-2017-3305 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6.35 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical…

    Published 24 Apr 2017 · NVD
  6. Medium 5.3

    CVE-2017-8104 · MyBB

    In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.

    Published 24 Apr 2017 · NVD
  7. Medium 6.1

    CVE-2017-8103 · MyBB

    In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.

    Published 24 Apr 2017 · NVD
  8. Medium 6.5

    CVE-2017-8082 · Concrete CMS

    concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators.

    Published 24 Apr 2017 · NVD
  9. Low 3.3

    CVE-2014-9680 · sudo

    sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

    Published 24 Apr 2017 · NVD
  10. Medium 5.3

    CVE-2017-8056 · WatchGuard Fireware OS

    WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The Firebox may also experience an overall…

    Published 22 Apr 2017 · NVD
  11. Medium 5.3

    CVE-2017-8055 · WatchGuard Fireware OS

    WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this vulnerability to enumerate valid usernames on an affected Firebox.

    Published 22 Apr 2017 · NVD
  12. Medium 6.1

    CVE-2017-8052 · Craft CMS

    Craft CMS before 2.6.2974 allows XSS attacks.

    Published 22 Apr 2017 · NVD
  13. High 7.8

    CVE-2016-5399 · PHP

    The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.

    Published 21 Apr 2017 · Fixed in 5.6.24, 7.0.9 · NVD
  14. Critical 9.8

    CVE-2016-3109 · Shopware

    The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.

    Published 21 Apr 2017 · NVD
  15. Medium 6.1

    CVE-2017-7409 · Palo Alto Networks PAN-OS

    Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674.

    Published 21 Apr 2017 · NVD
  16. High 7.7

    CVE-2017-6610 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of an affected system. The vulnerability is due to insufficient validation of the IKEv1 XAUTH parameters passed during an IKEv1 negotiation. An attacker could exploit this vulnerability by sending crafted parameters. Note: Only traffic…

    Published 20 Apr 2017 · NVD
  17. High 7.7

    CVE-2017-6609 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of malformed IPsec packets. An attacker could exploit this vulnerability by sending malformed IPsec packets to the affected system. Note: Only traffic directed to the affected system can be used to exploit…

    Published 20 Apr 2017 · NVD
  18. High 8.6

    CVE-2017-6608 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of crafted SSL or TLS packets. An attacker could exploit this vulnerability by sending a crafted packet to the affected system. Note: Only traffic…

    Published 20 Apr 2017 · NVD
  19. High 8.7

    CVE-2017-6607 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response messages. An attacker could exploit this vulnerability by triggering a DNS request from the Cisco ASA Software and…

    Published 20 Apr 2017 · NVD
  20. Medium 4.0

    CVE-2017-3793 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause Cisco ASA and FTD to drop any further incoming traffic on all interfaces, resulting in a denial of service (DoS) condition. The vulnerability is due to improper…

    Published 20 Apr 2017 · NVD
  21. High 8.8

    CVE-2016-3734 · Moodle

    Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.

    Published 20 Apr 2017 · NVD
  22. Medium 4.3

    CVE-2016-3733 · Moodle

    The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

    Published 20 Apr 2017 · NVD
  23. Medium 4.3

    CVE-2016-3732 · Moodle

    The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.

    Published 20 Apr 2017 · NVD
  24. Medium 5.3

    CVE-2016-3731 · Moodle

    Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.

    Published 20 Apr 2017 · NVD
  25. Medium 6.5

    CVE-2016-3729 · Moodle

    The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.

    Published 20 Apr 2017 · NVD
  26. Medium 6.5

    CVE-2016-7540 · ImageMagick

    coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image to rgf format.

    Published 20 Apr 2017 · NVD
  27. Medium 6.5

    CVE-2016-7536 · ImageMagick

    magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  28. Medium 6.5

    CVE-2016-7535 · ImageMagick

    coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  29. Medium 6.5

    CVE-2016-7534 · ImageMagick

    The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  30. Medium 6.5

    CVE-2016-7532 · ImageMagick

    coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  31. Medium 6.5

    CVE-2016-7530 · ImageMagick

    The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) via a crafted file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  32. Medium 6.5

    CVE-2016-7527 · ImageMagick

    coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  33. Medium 6.5

    CVE-2016-7526 · ImageMagick

    coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  34. Medium 6.5

    CVE-2016-7525 · ImageMagick

    Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  35. Medium 6.5

    CVE-2016-7521 · ImageMagick

    Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  36. Medium 6.5

    CVE-2016-7520 · ImageMagick

    Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  37. Medium 6.5

    CVE-2016-7518 · ImageMagick

    The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SUN file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  38. Medium 6.5

    CVE-2016-7517 · ImageMagick

    The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PICT file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  39. Medium 6.5

    CVE-2016-7516 · ImageMagick

    The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted VIFF file.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  40. Medium 6.5

    CVE-2016-7514 · ImageMagick

    The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.

    Published 20 Apr 2017 · Fixed in 7.0.1-0 · NVD
  41. Medium 6.5

    CVE-2016-7513 · ImageMagick

    Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors.

    Published 20 Apr 2017 · Fixed in 6.9.4-0 · NVD
  42. Medium 6.5

    CVE-2016-5010 · ImageMagick

    coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file.

    Published 20 Apr 2017 · NVD
  43. Medium 6.5

    CVE-2015-8959 · ImageMagick

    coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.

    Published 20 Apr 2017 · NVD
  44. Medium 6.5

    CVE-2015-8958 · ImageMagick

    coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.

    Published 20 Apr 2017 · NVD
  45. Medium 6.5

    CVE-2015-8957 · ImageMagick

    Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.

    Published 20 Apr 2017 · NVD
  46. High 7.5

    CVE-2016-6337 · MediaWiki

    MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.

    Published 20 Apr 2017 · NVD
  47. Medium 6.5

    CVE-2016-6336 · MediaWiki

    MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.

    Published 20 Apr 2017 · NVD
  48. High 7.5

    CVE-2016-6335 · MediaWiki

    MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.

    Published 20 Apr 2017 · NVD
  49. Medium 6.1

    CVE-2016-6334 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.

    Published 20 Apr 2017 · NVD
  50. Medium 6.1

    CVE-2016-6333 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.

    Published 20 Apr 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.