UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,939
Published in 7 days
1,032
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,939 vulnerabilities
  1. Medium 6.1

    CVE-2016-3999 · Zimbra Collaboration

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 104552 and 104703.

    Published 18 Jan 2017 · NVD
  2. Critical 9.1

    CVE-2016-3415 · Zimbra Collaboration

    Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276.

    Published 18 Jan 2017 · NVD
  3. Medium 6.5

    CVE-2016-3414 · Zimbra Collaboration

    Unspecified vulnerability in Zimbra Collaboration before 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown vectors, aka bug 102029.

    Published 18 Jan 2017 · NVD
  4. High 7.5

    CVE-2016-3413 · Zimbra Collaboration

    Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103996.

    Published 18 Jan 2017 · NVD
  5. Medium 6.1

    CVE-2016-3412 · Zimbra Collaboration

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 103997, 104413, 104414, 104777, and 104791.

    Published 18 Jan 2017 · NVD
  6. Medium 6.1

    CVE-2016-3411 · Zimbra Collaboration

    Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug 103609.

    Published 18 Jan 2017 · NVD
  7. Medium 6.1

    CVE-2016-3410 · Zimbra Collaboration

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 103956, 103995, 104475, 104838, and 104839.

    Published 18 Jan 2017 · NVD
  8. Medium 6.1

    CVE-2016-3409 · Zimbra Collaboration

    Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug 102637.

    Published 18 Jan 2017 · NVD
  9. Medium 6.1

    CVE-2016-3408 · Zimbra Collaboration

    Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug 101813.

    Published 18 Jan 2017 · NVD
  10. Medium 6.1

    CVE-2016-3407 · Zimbra Collaboration

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 104222, 104910, 105071, and 105175.

    Published 18 Jan 2017 · NVD
  11. High 8.8

    CVE-2016-3406 · Zimbra Collaboration

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the Client uploader extension or (2) extension REST handlers, aka bugs 104294 and 104456.

    Published 18 Jan 2017 · NVD
  12. High 7.5

    CVE-2016-3405 · Zimbra Collaboration

    Multiple unspecified vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to affect integrity via unknown vectors, aka bugs 103961 and 104828.

    Published 18 Jan 2017 · NVD
  13. High 7.5

    CVE-2016-3404 · Zimbra Collaboration

    Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103959.

    Published 18 Jan 2017 · NVD
  14. High 7.5

    CVE-2016-3402 · Zimbra Collaboration

    Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect confidentiality via unknown vectors, aka bug 99167.

    Published 18 Jan 2017 · NVD
  15. Medium 6.5

    CVE-2016-3401 · Zimbra Collaboration

    Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, aka bug 99810.

    Published 18 Jan 2017 · NVD
  16. Medium 6.5

    CVE-2016-6897 · WordPress

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.

    Published 18 Jan 2017 · NVD
  17. High 7.1

    CVE-2016-6896 · WordPress

    Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.

    Published 18 Jan 2017 · NVD
  18. Medium 4.3

    CVE-2016-10148 · WordPress

    The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.

    Published 18 Jan 2017 · NVD
  19. High 7.4

    CVE-2016-7999 · SPIP

    ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.

    Published 18 Jan 2017 · NVD
  20. High 8.8

    CVE-2016-7998 · SPIP

    The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.

    Published 18 Jan 2017 · NVD
  21. High 7.5

    CVE-2016-7982 · SPIP

    Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.

    Published 18 Jan 2017 · NVD
  22. Medium 6.1

    CVE-2016-7981 · SPIP

    Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.

    Published 18 Jan 2017 · NVD
  23. High 8.8

    CVE-2016-7980 · SPIP

    Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request. NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.

    Published 18 Jan 2017 · NVD
  24. Medium 5.5

    CVE-2016-7906 · ImageMagick

    magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.

    Published 18 Jan 2017 · NVD
  25. Medium 6.5

    CVE-2016-7799 · ImageMagick

    MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

    Published 18 Jan 2017 · Fixed in 6.9.6-0, 7.0.3-2 · NVD
  26. Medium 6.5

    CVE-2016-7101 · ImageMagick

    The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.

    Published 18 Jan 2017 · Fixed in 6.9.5-8, 7.0.2-10 · NVD
  27. High 7.5

    CVE-2016-6823 · ImageMagick

    Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.

    Published 18 Jan 2017 · Fixed in 6.9.10-50, 7.0.2-10 · NVD
  28. Medium 5.5

    CVE-2017-5223 · PHPMailer

    An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute…

    Published 16 Jan 2017 · NVD
  29. High 7.5

    CVE-2017-5493 · WordPress

    wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

    Published 15 Jan 2017 · NVD
  30. High 8.8

    CVE-2017-5492 · WordPress

    Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.

    Published 15 Jan 2017 · NVD
  31. Medium 5.3

    CVE-2017-5491 · WordPress

    wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.

    Published 15 Jan 2017 · NVD
  32. Medium 6.1

    CVE-2017-5490 · WordPress

    Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.

    Published 15 Jan 2017 · NVD
  33. High 8.8

    CVE-2017-5489 · WordPress

    Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload.

    Published 15 Jan 2017 · NVD
  34. Medium 6.1

    CVE-2017-5488 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.

    Published 15 Jan 2017 · NVD
  35. Medium 5.3

    CVE-2017-5487 · WordPress

    wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

    Published 15 Jan 2017 · NVD
  36. High 8.8

    CVE-2010-5327 · Liferay Portal / DXP

    Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

    Published 13 Jan 2017 · NVD
  37. Critical 9.8

    CVE-2016-9299 · Jenkins

    The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

    Published 12 Jan 2017 · NVD
  38. High 7.5

    CVE-2016-9444 · BIND 9

    named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an answer.

    Published 12 Jan 2017 · NVD
  39. High 7.5

    CVE-2016-9147 · BIND 9

    named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related RRsets.

    Published 12 Jan 2017 · NVD
  40. High 7.5

    CVE-2016-9131 · BIND 9

    named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.

    Published 12 Jan 2017 · NVD
  41. Critical 9.8

    CVE-2016-7479 · PHP

    In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.

    Published 12 Jan 2017 · NVD
  42. Critical 9.8

    CVE-2016-7480 · PHP

    The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.

    Published 11 Jan 2017 · Fixed in 7.0.11 · NVD
  43. Critical 9.8

    CVE-2017-5340 · PHP

    Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.

    Published 11 Jan 2017 · Fixed in 7.0.15, 7.1.1 · NVD
  44. High 7.5

    CVE-2016-7478 · PHP

    Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.

    Published 11 Jan 2017 · NVD
  45. Medium 5.9

    CVE-2016-9247 · F5 BIG-IP

    Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific sequence of packets may cause the Traffic Management Microkernel (TMM) to restart.

    Published 10 Jan 2017 · NVD
  46. Critical 9.8

    CVE-2016-10126 · Splunk Enterprise

    Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.

    Published 10 Jan 2017 · NVD
  47. High 7.5

    CVE-2016-9879 · IBM WebSphere Application Server

    An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling…

    Published 6 Jan 2017 · NVD
  48. High 8.1

    CVE-2016-8706 · Memcached

    An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

    Published 6 Jan 2017 · NVD
  49. Critical 9.8

    CVE-2016-8705 · Memcached

    Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

    Published 6 Jan 2017 · NVD
  50. Critical 9.8

    CVE-2016-8704 · Memcached

    An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

    Published 6 Jan 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.