UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,937
Published in 7 days
1,032
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,937 vulnerabilities
  1. Medium 6.5

    CVE-2015-8902 · ImageMagick

    The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted PDB file.

    Published 27 Feb 2017 · Fixed in 6.9.0-5 · NVD
  2. Medium 6.5

    CVE-2015-8901 · ImageMagick

    ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file.

    Published 27 Feb 2017 · Fixed in 6.9.0-5 · NVD
  3. Medium 5.5

    CVE-2015-8900 · ImageMagick

    The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.

    Published 27 Feb 2017 · NVD
  4. Medium 5.9

    CVE-2017-6297 · MikroTik RouterOS

    The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.

    Published 27 Feb 2017 · NVD
  5. Medium 6.5

    CVE-2016-9384 · Xen

    Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.

    Published 22 Feb 2017 · NVD
  6. Medium 5.5

    CVE-2016-9378 · Xen

    Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.

    Published 22 Feb 2017 · NVD
  7. Medium 5.5

    CVE-2016-9377 · Xen

    Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.

    Published 22 Feb 2017 · NVD
  8. Medium 5.3

    CVE-2016-6249 · F5 BIG-IP

    F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files.

    Published 20 Feb 2017 · NVD
  9. Medium 5.5

    CVE-2016-9773 · ImageMagick

    Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9556.

    Published 17 Feb 2017 · NVD
  10. Medium 5.9

    CVE-2016-8652 · Dovecot

    The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.

    Published 17 Feb 2017 · NVD
  11. High 7.5

    CVE-2016-5417 · GNU C Library

    Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures.

    Published 17 Feb 2017 · NVD
  12. Critical 9.8

    CVE-2016-10134 · Zabbix

    SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

    Published 17 Feb 2017 · NVD
  13. Medium 5.5

    CVE-2016-8678 · ImageMagick

    The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file. NOTE: the vendor says "This is a Q64 issue and we do not support Q64."

    Published 15 Feb 2017 · NVD
  14. High 8.8

    CVE-2016-8677 · ImageMagick

    The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.

    Published 15 Feb 2017 · Fixed in 6.9.5-10, 7.0.3-1 · NVD
  15. High 8.8

    CVE-2016-8866 · ImageMagick

    The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.

    Published 15 Feb 2017 · Fixed in 6.9.6-6 · NVD
  16. High 8.8

    CVE-2016-8862 · ImageMagick

    The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick before 7.0.3.3 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.

    Published 15 Feb 2017 · Fixed in 6.9.4-0, 7.0.3-3 · NVD
  17. Medium 5.4

    CVE-2017-1121 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743

    Published 13 Feb 2017 · NVD
  18. Critical 9.8

    CVE-2016-5100 · Froxlor

    Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.

    Published 13 Feb 2017 · NVD
  19. Medium 5.9

    CVE-2016-6210 · OpenSSH

    sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

    Published 13 Feb 2017 · NVD
  20. High 7.5

    CVE-2017-3302 · MariaDB, MySQL

    Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

    Published 12 Feb 2017 · Fixed in 5.6.21, 5.7.5 · NVD
  21. High 8.8

    CVE-2017-3807 · Cisco ASA and Firepower Threat Defense

    A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-9.6, could allow an authenticated, remote attacker to cause a heap overflow. The vulnerability is due to insufficient validation of user supplied input. An attacker could exploit this vulnerability by sending a crafted URL to the affected system. An exploit…

    Published 9 Feb 2017 · NVD
  22. High 7.5

    CVE-2016-9244 · F5 BIG-IP

    A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

    Published 9 Feb 2017 · NVD
  23. Critical 9.8

    CVE-2016-10192 · FFmpeg

    Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.

    Published 9 Feb 2017 · NVD
  24. Critical 9.8

    CVE-2016-10191 · FFmpeg

    Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.

    Published 9 Feb 2017 · NVD
  25. Critical 9.8

    CVE-2016-10190 · FFmpeg

    Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.

    Published 9 Feb 2017 · NVD
  26. Medium 5.9

    CVE-2016-8492 · Fortinet FortiOS

    The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption.

    Published 8 Feb 2017 · NVD
  27. Critical 9.8

    CVE-2015-2794 · DNN Platform

    The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

    Published 6 Feb 2017 · NVD
  28. Medium 6.5

    CVE-2017-5880 · Splunk Enterprise

    Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0.13, 5.0.x before 5.0.17 and Splunk Light versions before 6.5.2 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted GET request, aka SPL-130279.

    Published 4 Feb 2017 · NVD
  29. Unrated

    WPV-997d4b495635 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Feb 2017 · Fixed in 1.4.9 · WPVulnerability
  30. Unrated

    WPV-82f1e034774d · Gtranslate (WordPress plugin)

    Vulnerability in Translate WordPress with GTranslate

    Published 3 Feb 2017 · Fixed in 2.8.11 · WPVulnerability
  31. High 7.5

    CVE-2016-8919 · IBM WebSphere Application Server

    IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources.

    Published 1 Feb 2017 · NVD
  32. Medium 5.4

    CVE-2016-8934 · IBM WebSphere Application Server

    IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 1 Feb 2017 · NVD
  33. Medium 5.9

    CVE-2016-9963 · Exim

    Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.

    Published 1 Feb 2017 · NVD
  34. Medium 6.4

    CVE-2016-9962 · Docker Engine

    RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.

    Published 31 Jan 2017 · Fixed in 1.12.6 · NVD
  35. Medium 6.1

    CVE-2016-9421 · MyBB

    Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 31 Jan 2017 · NVD
  36. Critical 9.8

    CVE-2016-9420 · MyBB

    MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."

    Published 31 Jan 2017 · NVD
  37. Medium 6.1

    CVE-2016-9419 · MyBB

    Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 31 Jan 2017 · NVD
  38. High 7.5

    CVE-2016-9418 · MyBB

    MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.

    Published 31 Jan 2017 · NVD
  39. High 7.4

    CVE-2016-9417 · MyBB

    The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.

    Published 31 Jan 2017 · NVD
  40. Critical 9.8

    CVE-2016-9416 · MyBB

    SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Published 31 Jan 2017 · NVD
  41. High 7.5

    CVE-2016-9415 · MyBB

    MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."

    Published 31 Jan 2017 · NVD
  42. High 7.5

    CVE-2016-9414 · MyBB

    MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.

    Published 31 Jan 2017 · NVD
  43. Medium 6.5

    CVE-2016-9413 · MyBB

    The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

    Published 31 Jan 2017 · NVD
  44. Critical 9.8

    CVE-2016-9412 · MyBB

    MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.

    Published 31 Jan 2017 · NVD
  45. Medium 5.3

    CVE-2016-9411 · MyBB

    The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.

    Published 31 Jan 2017 · NVD
  46. High 7.5

    CVE-2016-9410 · MyBB

    MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.

    Published 31 Jan 2017 · NVD
  47. Medium 6.1

    CVE-2016-9409 · MyBB

    Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.

    Published 31 Jan 2017 · NVD
  48. Medium 6.1

    CVE-2016-9408 · MyBB

    Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.

    Published 31 Jan 2017 · NVD
  49. Medium 6.1

    CVE-2016-9407 · MyBB

    Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.

    Published 31 Jan 2017 · NVD
  50. Medium 6.1

    CVE-2016-9406 · MyBB

    Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 31 Jan 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.