UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,937
Published in 7 days
1,032
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,937 vulnerabilities
  1. Medium 6.5

    CVE-2016-5549 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a…

    Published 27 Jan 2017 · NVD
  2. Medium 6.5

    CVE-2016-5548 · Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction…

    Published 27 Jan 2017 · NVD
  3. Medium 5.3

    CVE-2016-5547 · Java

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks…

    Published 27 Jan 2017 · NVD
  4. High 7.5

    CVE-2016-5546 · Java

    Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful…

    Published 27 Jan 2017 · NVD
  5. High 7.5

    CVE-2016-10003 · Squid

    Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.

    Published 27 Jan 2017 · Fixed in 3.5.23, 4.0.17 · NVD
  6. High 7.5

    CVE-2016-10002 · Squid

    Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

    Published 27 Jan 2017 · NVD
  7. Low 3.3

    CVE-2016-9932 · Xen

    CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.

    Published 26 Jan 2017 · NVD
  8. Medium 5.5

    CVE-2016-10025 · Xen

    VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

    Published 26 Jan 2017 · NVD
  9. Medium 6.0

    CVE-2016-10024 · Xen

    Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.

    Published 26 Jan 2017 · NVD
  10. High 7.8

    CVE-2016-10013 · Xen

    Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.

    Published 26 Jan 2017 · NVD
  11. High 7.5

    CVE-2016-10162 · PHP

    The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.

    Published 24 Jan 2017 · NVD
  12. High 7.5

    CVE-2016-10161 · PHP

    The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.

    Published 24 Jan 2017 · NVD
  13. Critical 9.8

    CVE-2016-10160 · PHP

    Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

    Published 24 Jan 2017 · Fixed in 5.6.30, 7.0.15, 7.1.1 · NVD
  14. High 7.5

    CVE-2016-10159 · PHP

    Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.

    Published 24 Jan 2017 · Fixed in 7.0.15 · NVD
  15. High 7.5

    CVE-2016-10158 · PHP

    The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.

    Published 24 Jan 2017 · NVD
  16. High 7.8

    CVE-2016-9386 · Xen

    The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.

    Published 23 Jan 2017 · NVD
  17. Medium 6.0

    CVE-2016-9385 · Xen

    The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.

    Published 23 Jan 2017 · NVD
  18. High 8.8

    CVE-2016-9383 · Xen

    Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.

    Published 23 Jan 2017 · NVD
  19. High 7.8

    CVE-2016-9382 · Xen

    Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.

    Published 23 Jan 2017 · NVD
  20. High 7.5

    CVE-2016-9380 · Xen

    The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.

    Published 23 Jan 2017 · NVD
  21. High 7.9

    CVE-2016-9379 · Xen

    The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.

    Published 23 Jan 2017 · NVD
  22. Critical 9.8

    CVE-2016-9081 · Joomla!

    Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors.

    Published 23 Jan 2017 · NVD
  23. High 7.5

    CVE-2016-6920 · FFmpeg

    Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (application crash) via vectors involving tile positions.

    Published 23 Jan 2017 · NVD
  24. High 7.5

    CVE-2016-6668 · Confluence

    The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.

    Published 23 Jan 2017 · NVD
  25. Critical 9.8

    CVE-2016-6164 · FFmpeg

    Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.

    Published 23 Jan 2017 · NVD
  26. Critical 9.8

    CVE-2016-5742 · Movable Type

    SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Published 23 Jan 2017 · NVD
  27. High 8.1

    CVE-2016-5091 · TYPO3

    Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.

    Published 23 Jan 2017 · NVD
  28. High 8.8

    CVE-2016-4340 · GitLab

    The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.

    Published 23 Jan 2017 · NVD
  29. High 8.1

    CVE-2016-4338 · Zabbix

    The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.

    Published 23 Jan 2017 · NVD
  30. Medium 6.1

    CVE-2016-4056 · TYPO3

    Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.

    Published 23 Jan 2017 · NVD
  31. Critical 9.8

    CVE-2016-4010 · Magento / Adobe Commerce

    Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.

    Published 23 Jan 2017 · NVD
  32. High 7.5

    CVE-2015-8860 · Node.js

    The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

    Published 23 Jan 2017 · NVD
  33. High 7.5

    CVE-2015-8855 · Node.js

    The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

    Published 23 Jan 2017 · NVD
  34. Medium 6.1

    CVE-2014-9772 · Node.js

    The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.

    Published 23 Jan 2017 · NVD
  35. Medium 6.1

    CVE-2013-7454 · Node.js

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.

    Published 23 Jan 2017 · NVD
  36. Medium 6.1

    CVE-2013-7453 · Node.js

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.

    Published 23 Jan 2017 · NVD
  37. Medium 6.1

    CVE-2013-7452 · Node.js

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.

    Published 23 Jan 2017 · NVD
  38. Medium 6.1

    CVE-2013-7451 · Node.js

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.

    Published 23 Jan 2017 · NVD
  39. Medium 6.1

    CVE-2017-2578 · Moodle

    In Moodle 3.x, there is XSS in the assignment submission page.

    Published 20 Jan 2017 · NVD
  40. Medium 5.3

    CVE-2017-2576 · Moodle

    In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.

    Published 20 Jan 2017 · NVD
  41. Medium 5.3

    CVE-2016-8644 · Moodle

    In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.

    Published 20 Jan 2017 · NVD
  42. Medium 4.3

    CVE-2016-8643 · Moodle

    In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.

    Published 20 Jan 2017 · NVD
  43. Medium 5.3

    CVE-2016-8642 · Moodle

    In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.

    Published 20 Jan 2017 · NVD
  44. High 7.3

    CVE-2016-7038 · Moodle

    In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.

    Published 20 Jan 2017 · NVD
  45. Medium 5.4

    CVE-2016-5014 · Moodle

    In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.

    Published 20 Jan 2017 · NVD
  46. Medium 5.4

    CVE-2016-5013 · Moodle

    In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

    Published 20 Jan 2017 · NVD
  47. Medium 5.3

    CVE-2016-5012 · Moodle

    In Moodle 3.x, glossary search displays entries without checking user permissions to view them.

    Published 20 Jan 2017 · NVD
  48. High 7.5

    CVE-2016-4019 · Zimbra Collaboration

    Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 104477.

    Published 18 Jan 2017 · NVD
  49. Medium 6.1

    CVE-2016-3999 · Zimbra Collaboration

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 104552 and 104703.

    Published 18 Jan 2017 · NVD
  50. Critical 9.1

    CVE-2016-3415 · Zimbra Collaboration

    Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276.

    Published 18 Jan 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.