UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,937
Published in 7 days
1,032
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,937 vulnerabilities
  1. Critical 9.8

    CVE-2016-5239 · ImageMagick

    The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.

    Published 15 Mar 2017 · NVD
  2. High 8.1

    CVE-2015-8982 · GNU C Library

    Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

    Published 15 Mar 2017 · NVD
  3. Medium 5.5

    CVE-2015-8898 · ImageMagick

    The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.

    Published 15 Mar 2017 · NVD
  4. Medium 5.5

    CVE-2015-8897 · ImageMagick

    The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.

    Published 15 Mar 2017 · NVD
  5. Medium 6.5

    CVE-2015-8896 · ImageMagick

    Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.

    Published 15 Mar 2017 · Fixed in 6.9.4-0, 7.0.5-0 · NVD
  6. High 7.5

    CVE-2015-8895 · ImageMagick

    Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.

    Published 15 Mar 2017 · NVD
  7. Medium 5.5

    CVE-2015-8894 · ImageMagick

    Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.

    Published 15 Mar 2017 · NVD
  8. Medium 6.1

    CVE-2016-7103 · Oracle WebLogic Server

    Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

    Published 15 Mar 2017 · NVD
  9. Medium 5.4

    CVE-2017-5584 · Palo Alto Networks PAN-OS

    Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

    Published 15 Mar 2017 · NVD
  10. Medium 6.5

    CVE-2017-5583 · Palo Alto Networks PAN-OS

    The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors.

    Published 15 Mar 2017 · NVD
  11. High 7.5

    CVE-2016-10252 · ImageMagick

    Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory consumption.

    Published 14 Mar 2017 · NVD
  12. High 7.5

    CVE-2016-8747 · Apache Tomcat

    An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

    Published 14 Mar 2017 · Fixed in 8.5.10 · NVD
  13. Medium 6.1

    CVE-2017-6820 · Roundcube

    rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.

    Published 12 Mar 2017 · NVD
  14. High 7.5

    CVE-2017-6444 · MikroTik RouterOS

    The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many ACK packets. After the attacker stops the exploit, the CPU usage is 100% and the router requires a reboot for normal operation.

    Published 12 Mar 2017 · NVD
  15. Medium 6.5

    CVE-2017-6819 · WordPress

    In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.

    Published 12 Mar 2017 · NVD
  16. Medium 6.1

    CVE-2017-6818 · WordPress

    In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.

    Published 12 Mar 2017 · NVD
  17. Medium 5.4

    CVE-2017-6817 · WordPress

    In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.

    Published 12 Mar 2017 · NVD
  18. Medium 4.9

    CVE-2017-6816 · WordPress

    In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.

    Published 12 Mar 2017 · NVD
  19. Medium 6.1

    CVE-2017-6815 · WordPress

    In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.

    Published 12 Mar 2017 · NVD
  20. Medium 5.4

    CVE-2017-6814 · WordPress

    In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.

    Published 12 Mar 2017 · NVD
  21. Critical 9.8Actively exploited

    CVE-2017-5638 · Apache Struts, Oracle WebLogic Server

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header…

    Published 11 Mar 2017 · Fixed in 2.3.32, 2.5.10.1 · NVD
  22. Medium 5.9

    CVE-2016-9245 · F5 BIG-IP

    In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "Normalize URI" configuration options used in iRules and/or BIG-IP LTM policies. An attacker may be able to disrupt traffic or cause the BIG-IP…

    Published 7 Mar 2017 · NVD
  23. Medium 6.1

    CVE-2017-5197 · Silverstripe CMS

    There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.

    Published 6 Mar 2017 · NVD
  24. Medium 5.5

    CVE-2017-6502 · ImageMagick

    An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS).

    Published 6 Mar 2017 · NVD
  25. Medium 5.5

    CVE-2017-6501 · ImageMagick

    An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference.

    Published 6 Mar 2017 · NVD
  26. Medium 5.5

    CVE-2017-6500 · ImageMagick

    An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read.

    Published 6 Mar 2017 · NVD
  27. Medium 5.5

    CVE-2017-6499 · ImageMagick

    An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS).

    Published 6 Mar 2017 · NVD
  28. Medium 5.5

    CVE-2017-6498 · ImageMagick

    An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.

    Published 6 Mar 2017 · NVD
  29. High 7.5

    CVE-2017-6497 · ImageMagick

    An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus, a DoS).

    Published 6 Mar 2017 · NVD
  30. Medium 5.5

    CVE-2016-10070 · ImageMagick

    Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.

    Published 3 Mar 2017 · NVD
  31. Medium 5.5

    CVE-2016-10066 · ImageMagick

    Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a crafted file.

    Published 3 Mar 2017 · NVD
  32. High 7.8

    CVE-2016-10065 · ImageMagick

    The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 3 Mar 2017 · NVD
  33. Medium 6.5

    CVE-2016-10061 · ImageMagick

    The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.

    Published 3 Mar 2017 · Fixed in 6.9.4-8, 7.0.1-10 · NVD
  34. Medium 6.1

    CVE-2017-5614 · cPanel & WHM

    Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.

    Published 3 Mar 2017 · Fixed in 56.0.43, 58.0.43, 60.0.35 · NVD
  35. Medium 5.5

    CVE-2016-10071 · ImageMagick

    coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.

    Published 2 Mar 2017 · NVD
  36. Medium 5.5

    CVE-2016-10069 · ImageMagick

    coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.

    Published 2 Mar 2017 · NVD
  37. Medium 5.5

    CVE-2016-10068 · ImageMagick

    The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.

    Published 2 Mar 2017 · NVD
  38. High 7.5

    CVE-2016-10067 · ImageMagick

    magick/memory.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via vectors involving "too many exceptions," which trigger a buffer overflow.

    Published 2 Mar 2017 · NVD
  39. High 7.8

    CVE-2016-10064 · ImageMagick

    Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 2 Mar 2017 · NVD
  40. High 7.8

    CVE-2016-10063 · ImageMagick

    Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file, related to extend validity.

    Published 2 Mar 2017 · NVD
  41. Medium 5.5

    CVE-2016-10062 · ImageMagick

    The ReadGROUP4Image function in coders/tiff.c in ImageMagick does not check the return value of the fwrite function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.

    Published 2 Mar 2017 · Fixed in 7.0.1-10 · NVD
  42. Medium 6.5

    CVE-2016-10060 · ImageMagick

    The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.

    Published 2 Mar 2017 · Fixed in 6.9.4-1, 7.0.1-10 · NVD
  43. High 7.5

    CVE-2015-8994 · PHP

    An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache…

    Published 2 Mar 2017 · Fixed in 7.0.14 · NVD
  44. Medium 5.9

    CVE-2016-10228 · GNU C Library

    The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

    Published 2 Mar 2017 · NVD
  45. Medium 6.5

    CVE-2016-9559 · ImageMagick

    coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.

    Published 1 Mar 2017 · Fixed in 6.9.6-5, 7.0.3-7 · NVD
  46. Medium 6.5

    CVE-2016-9818 · Xen

    Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP.

    Published 27 Feb 2017 · NVD
  47. Medium 6.5

    CVE-2016-9817 · Xen

    Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR_EL2.EA bit set.

    Published 27 Feb 2017 · NVD
  48. Medium 6.5

    CVE-2016-9816 · Xen

    Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2.

    Published 27 Feb 2017 · NVD
  49. Medium 6.5

    CVE-2016-9815 · Xen

    Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort.

    Published 27 Feb 2017 · NVD
  50. Medium 6.5

    CVE-2015-8903 · ImageMagick

    The ReadVICARImage function in coders/vicar.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted VICAR file.

    Published 27 Feb 2017 · Fixed in 6.9.0-5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.