UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,937
Published in 7 days
1,032
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,937 vulnerabilities
  1. High 7.8

    CVE-2016-10054 · ImageMagick

    Buffer overflow in the WriteMAPImage function in coders/map.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 23 Mar 2017 · NVD
  2. Medium 5.5

    CVE-2016-10053 · ImageMagick

    The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.

    Published 23 Mar 2017 · NVD
  3. High 7.8

    CVE-2016-10052 · ImageMagick

    Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 23 Mar 2017 · NVD
  4. High 7.8

    CVE-2016-10051 · ImageMagick

    Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 23 Mar 2017 · NVD
  5. High 7.8

    CVE-2016-10050 · ImageMagick

    Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.

    Published 23 Mar 2017 · NVD
  6. High 7.8

    CVE-2016-10049 · ImageMagick

    Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.

    Published 23 Mar 2017 · NVD
  7. High 7.5

    CVE-2016-10048 · ImageMagick

    Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.

    Published 23 Mar 2017 · NVD
  8. Medium 5.5

    CVE-2016-10047 · ImageMagick

    Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML file.

    Published 23 Mar 2017 · NVD
  9. Medium 5.5

    CVE-2016-10046 · ImageMagick

    Heap-based buffer overflow in the DrawImage function in magick/draw.c in ImageMagick before 6.9.5-5 allows remote attackers to cause a denial of service (application crash) via a crafted image file.

    Published 23 Mar 2017 · NVD
  10. Medium 5.5

    CVE-2014-9915 · ImageMagick

    Off-by-one error in ImageMagick before 6.6.0-4 allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM profile.

    Published 23 Mar 2017 · NVD
  11. High 7.8

    CVE-2016-9775 · Apache Tomcat

    The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10;…

    Published 23 Mar 2017 · NVD
  12. High 7.8

    CVE-2016-9774 · Apache Tomcat

    The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before…

    Published 23 Mar 2017 · NVD
  13. Medium 5.9

    CVE-2016-7468 · F5 BIG-IP

    An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerability affects virtual servers associated with TCP profiles when the BIG-IP system's tm.tcpprogressive db variable value is set to non-default setting "enabled". The default value for the tm.tcpprogressive db variable is "negotiate". An…

    Published 23 Mar 2017 · NVD
  14. Medium 5.5

    CVE-2014-9840 · ImageMagick

    ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted palm file.

    Published 22 Mar 2017 · NVD
  15. High 7.5

    CVE-2014-9839 · ImageMagick

    magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access).

    Published 22 Mar 2017 · NVD
  16. Medium 5.5

    CVE-2014-9838 · ImageMagick

    magick/cache.c in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (crash).

    Published 22 Mar 2017 · NVD
  17. Medium 5.5

    CVE-2014-9836 · ImageMagick

    ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service via a crafted xpm file.

    Published 22 Mar 2017 · NVD
  18. High 7.8

    CVE-2014-9835 · ImageMagick

    Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file.

    Published 22 Mar 2017 · NVD
  19. High 7.8

    CVE-2014-9834 · ImageMagick

    Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file.

    Published 22 Mar 2017 · NVD
  20. High 7.8

    CVE-2014-9833 · ImageMagick

    Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file.

    Published 22 Mar 2017 · NVD
  21. High 7.8

    CVE-2014-9832 · ImageMagick

    Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file.

    Published 22 Mar 2017 · NVD
  22. Medium 5.5

    CVE-2017-7207 · Ghostscript

    The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document.

    Published 21 Mar 2017 · NVD
  23. High 7.1

    CVE-2016-6816 · Apache Tomcat

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the…

    Published 20 Mar 2017 · NVD
  24. High 8.1

    CVE-2017-1151 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system. IBM Reference #: 1999293.

    Published 20 Mar 2017 · NVD
  25. Medium 5.9

    CVE-2015-8985 · GNU C Library

    The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

    Published 20 Mar 2017 · Fixed in 2.28 · NVD
  26. Medium 5.9

    CVE-2015-8984 · GNU C Library

    The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.

    Published 20 Mar 2017 · NVD
  27. High 8.1

    CVE-2015-8983 · GNU C Library

    Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.

    Published 20 Mar 2017 · NVD
  28. High 7.5

    CVE-2014-9851 · ImageMagick

    ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).

    Published 20 Mar 2017 · NVD
  29. High 7.5

    CVE-2014-9850 · ImageMagick

    Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).

    Published 20 Mar 2017 · NVD
  30. High 7.5

    CVE-2014-9849 · ImageMagick

    The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).

    Published 20 Mar 2017 · NVD
  31. High 7.5

    CVE-2014-9848 · ImageMagick

    Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).

    Published 20 Mar 2017 · Fixed in 6.9.4-0 · NVD
  32. Critical 9.8

    CVE-2014-9847 · ImageMagick

    The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact.

    Published 20 Mar 2017 · NVD
  33. Critical 9.8

    CVE-2014-9846 · ImageMagick

    Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.

    Published 20 Mar 2017 · NVD
  34. Medium 5.5

    CVE-2014-9845 · ImageMagick

    The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.

    Published 20 Mar 2017 · NVD
  35. Medium 5.5

    CVE-2014-9844 · ImageMagick

    The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.

    Published 20 Mar 2017 · NVD
  36. Critical 9.8

    CVE-2014-9843 · ImageMagick

    The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.

    Published 20 Mar 2017 · NVD
  37. High 7.5

    CVE-2014-9842 · ImageMagick

    Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

    Published 20 Mar 2017 · NVD
  38. Critical 9.8

    CVE-2014-9841 · ImageMagick

    The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions."

    Published 20 Mar 2017 · NVD
  39. High 7.8

    CVE-2012-5361 · FFmpeg

    Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file.

    Published 20 Mar 2017 · NVD
  40. Medium 6.1

    CVE-2016-8855 · Sitecore Experience Platform

    Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3) allows remote attacks via the Name or Description parameter. This is fixed in 8.2 Update-2.

    Published 19 Mar 2017 · NVD
  41. Critical 9.8

    CVE-2016-10253 · Erlang/OTP

    An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.

    Published 18 Mar 2017 · NVD
  42. Medium 5.3

    CVE-2017-3867 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Border Gateway Protocol (BGP) Bidirectional Forwarding Detection (BFD) implementation of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to bypass the access control list (ACL) for specific TCP and UDP traffic. More Information: CSCvc68229. Known Affected Releases: 9.6(2). Known Fixed Releases: 99.1(20.1) 99.1(10.2)…

    Published 17 Mar 2017 · NVD
  43. Medium 5.3

    CVE-2017-6370 · TYPO3

    TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

    Published 17 Mar 2017 · NVD
  44. High 7.5

    CVE-2014-9854 · ImageMagick

    coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image."

    Published 17 Mar 2017 · Fixed in 6.9.4-0 · NVD
  45. Medium 5.5

    CVE-2014-9853 · ImageMagick

    Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.

    Published 17 Mar 2017 · Fixed in 6.9.4-0 · NVD
  46. Critical 9.8

    CVE-2014-9852 · ImageMagick

    distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.

    Published 17 Mar 2017 · Fixed in 6.9.4-0 · NVD
  47. Medium 6.1

    CVE-2017-0110 · Microsoft Exchange Server

    Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

    Published 17 Mar 2017 · NVD
  48. High 8.1

    CVE-2017-6381 · Drupal

    A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you…

    Published 16 Mar 2017 · NVD
  49. High 7.5

    CVE-2017-6379 · Drupal

    Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

    Published 16 Mar 2017 · NVD
  50. High 7.5

    CVE-2017-6377 · Drupal

    When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.

    Published 16 Mar 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.