UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,940
Published in 7 days
1,033
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,940 vulnerabilities
  1. High 8.8

    CVE-2016-6609 · phpMyAdmin

    An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

    Published 11 Dec 2016 · NVD
  2. Medium 6.1

    CVE-2016-6608 · phpMyAdmin

    XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.

    Published 11 Dec 2016 · NVD
  3. Medium 6.1

    CVE-2016-6607 · phpMyAdmin

    XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and…

    Published 11 Dec 2016 · NVD
  4. High 8.1

    CVE-2016-6606 · phpMyAdmin

    An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the…

    Published 11 Dec 2016 · NVD
  5. Medium 4.4

    CVE-2016-4412 · phpMyAdmin

    An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.

    Published 11 Dec 2016 · NVD
  6. High 7.1

    CVE-2016-5424 · PostgreSQL

    PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.

    Published 9 Dec 2016 · NVD
  7. High 8.3

    CVE-2016-5423 · PostgreSQL

    PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL…

    Published 9 Dec 2016 · NVD
  8. Critical 9.8

    CVE-2016-6501 · JFrog Artifactory

    JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning.

    Published 9 Dec 2016 · NVD
  9. High 7.5

    CVE-2016-8858 · OpenSSH

    The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."

    Published 9 Dec 2016 · NVD
  10. High 7.5

    CVE-2016-9920 · Roundcube

    steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.

    Published 8 Dec 2016 · NVD
  11. Medium 4.8

    CVE-2016-10112 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 7 Dec 2016 · Fixed in 2.6.9 · NVD, WPVulnerability
  12. High 7.5

    CVE-2016-8740 · Apache HTTP Server

    The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

    Published 5 Dec 2016 · NVD
  13. Medium 6.1

    CVE-2016-9152 · SPIP

    Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter.

    Published 5 Dec 2016 · NVD
  14. Critical 9.8

    CVE-2016-9836 · Joomla!

    The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the `.php6`, `.php7`, `.phtml`, and `.phpt` extensions. Additionally, JHelperMedia::canUpload() did not blacklist these file extensions as uploadable file types.

    Published 5 Dec 2016 · NVD
  15. High 7.8

    CVE-2016-1247 · nginx

    The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

    Published 29 Nov 2016 · NVD
  16. Medium 6.5

    CVE-2016-9452 · Drupal

    The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.

    Published 25 Nov 2016 · NVD
  17. Medium 6.8

    CVE-2016-9451 · Drupal

    Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.

    Published 25 Nov 2016 · NVD
  18. High 7.5

    CVE-2016-9450 · Drupal

    The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.

    Published 25 Nov 2016 · NVD
  19. Medium 4.3

    CVE-2016-9449 · Drupal

    The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.

    Published 25 Nov 2016 · NVD
  20. Low 3.7

    CVE-2016-0378 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception.

    Published 24 Nov 2016 · NVD
  21. High 7.8

    CVE-2016-9151 · Palo Alto Networks PAN-OS

    Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows local users to gain privileges via crafted values of unspecified environment variables.

    Published 19 Nov 2016 · Fixed in 6.1.15, 7.0.11, 7.1.6 · NVD
  22. Critical 9.8

    CVE-2016-9150 · Palo Alto Networks PAN-OS

    Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors.

    Published 19 Nov 2016 · Fixed in 6.1.15, 7.0.11, 7.1.6 · NVD
  23. Medium 6.5

    CVE-2016-9149 · Palo Alto Networks PAN-OS

    The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XPath injection attacks via a crafted string.

    Published 19 Nov 2016 · Fixed in 6.1.15, 7.0.11, 7.1.6 · NVD
  24. Medium 5.9

    CVE-2016-6461 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to inject arbitrary XML commands on the affected system. More Information: CSCva38556. Known Affected Releases: 9.1(6.10). Known Fixed Releases: 100.11(0.75) 100.15(0.137) 100.8(40.129) 96.2(0.95) 97.1(0.55) 97.1(12.7) 97.1(6.30).

    Published 19 Nov 2016 · NVD
  25. Medium 5.5

    CVE-2016-9318 · libxml2

    libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

    Published 16 Nov 2016 · NVD
  26. High 7.0Actively exploited

    CVE-2016-5195 · Palo Alto Networks PAN-OS

    Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

    Published 10 Nov 2016 · Fixed in 7.0.14, 7.1.8 · NVD
  27. Unrated

    WPV-803a86c7f6a6 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 10 Nov 2016 · Fixed in 0.9.5 · WPVulnerability
  28. High 8.1

    CVE-2016-8870 · Joomla!

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

    Published 4 Nov 2016 · NVD
  29. Critical 9.8

    CVE-2016-8869 · Joomla!

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.

    Published 4 Nov 2016 · NVD
  30. Medium 6.1

    CVE-2016-9188 · Moodle

    Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters.

    Published 4 Nov 2016 · NVD
  31. High 8.8

    CVE-2016-9187 · Moodle

    Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.

    Published 4 Nov 2016 · NVD
  32. High 8.8

    CVE-2016-9186 · Moodle

    Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.

    Published 4 Nov 2016 · NVD
  33. Medium 6.5

    CVE-2016-9086 · GitLab

    GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was made available to all users.…

    Published 3 Nov 2016 · NVD
  34. High 7.5

    CVE-2016-8864 · BIND 9

    named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.

    Published 2 Nov 2016 · Fixed in 9.9.9, 9.10.4 · NVD
  35. Unrated

    WPV-3a86881f34e4 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 31 Oct 2016 · Fixed in 0.9.5 · WPVulnerability
  36. High 7.5

    CVE-2016-8867 · Docker Engine

    Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.

    Published 28 Oct 2016 · NVD
  37. High 7.5

    CVE-2016-7919 · Moodle

    Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly;…

    Published 28 Oct 2016 · NVD
  38. High 8.1

    CVE-2016-6432 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Identity Firewall feature of Cisco ASA Software before 9.6(2.1) could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending a crafted NetBIOS packet in response to a NetBIOS probe sent by…

    Published 27 Oct 2016 · NVD
  39. High 7.5

    CVE-2016-6431 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of crafted packets during the enrollment operation. An attacker could exploit this vulnerability by sending a crafted enrollment request to the affected system.…

    Published 27 Oct 2016 · NVD
  40. Medium 4.4

    CVE-2016-8290 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-5633.

    Published 25 Oct 2016 · NVD
  41. Medium 4.7

    CVE-2016-8289 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  42. Low 3.1

    CVE-2016-8288 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin.

    Published 25 Oct 2016 · NVD
  43. Medium 4.5

    CVE-2016-8287 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication.

    Published 25 Oct 2016 · NVD
  44. Low 3.1

    CVE-2016-8286 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.

    Published 25 Oct 2016 · NVD
  45. Low 1.8

    CVE-2016-8284 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.

    Published 25 Oct 2016 · NVD
  46. Medium 4.3

    CVE-2016-8283 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.38 · NVD
  47. Medium 4.9

    CVE-2016-5635 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit.

    Published 25 Oct 2016 · NVD
  48. Medium 4.9

    CVE-2016-5634 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR.

    Published 25 Oct 2016 · NVD
  49. Medium 4.9

    CVE-2016-5633 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-8290.

    Published 25 Oct 2016 · NVD
  50. Medium 4.9

    CVE-2016-5632 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer.

    Published 25 Oct 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.