UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,940
Published in 7 days
1,034
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,940 vulnerabilities
  1. Medium 4.9

    CVE-2016-5631 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Memcached.

    Published 25 Oct 2016 · NVD
  2. Medium 4.9

    CVE-2016-5630 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · Fixed in 10.0.27 · NVD
  3. Medium 4.9

    CVE-2016-5629 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  4. Medium 4.9

    CVE-2016-5628 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: DML.

    Published 25 Oct 2016 · NVD
  5. Medium 6.5

    CVE-2016-5627 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  6. Medium 6.5

    CVE-2016-5626 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  7. High 7.0

    CVE-2016-5625 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Packaging.

    Published 25 Oct 2016 · NVD
  8. Medium 6.5

    CVE-2016-5624 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  9. Medium 6.5

    CVE-2016-5612 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 25 Oct 2016 · Fixed in 5.5.51, 10.0.27 · NVD
  10. Medium 6.5

    CVE-2016-5609 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 25 Oct 2016 · NVD
  11. Medium 6.3

    CVE-2016-5601 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3.0, 12.2.1.0, and 12.2.1.1 allows local users to affect confidentiality and integrity via vectors related to CIE Related Components.

    Published 25 Oct 2016 · NVD
  12. Medium 5.9

    CVE-2016-5597 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking.

    Published 25 Oct 2016 · NVD
  13. Medium 4.4

    CVE-2016-5584 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier allows remote administrators to affect confidentiality via vectors related to Server: Security: Encryption.

    Published 25 Oct 2016 · Fixed in 5.5.53, 10.0.28, 10.1.19 · NVD
  14. Critical 9.6

    CVE-2016-5582 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573.

    Published 25 Oct 2016 · NVD
  15. High 8.3

    CVE-2016-5573 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5582.

    Published 25 Oct 2016 · NVD
  16. Critical 9.6

    CVE-2016-5568 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.

    Published 25 Oct 2016 · NVD
  17. Critical 9.6

    CVE-2016-5556 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.

    Published 25 Oct 2016 · NVD
  18. Medium 4.3

    CVE-2016-5554 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX.

    Published 25 Oct 2016 · NVD
  19. Low 3.1

    CVE-2016-5542 · Java

    Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries.

    Published 25 Oct 2016 · NVD
  20. Critical 9.8

    CVE-2016-5535 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 25 Oct 2016 · NVD
  21. Critical 9.8

    CVE-2016-5531 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices.

    Published 25 Oct 2016 · NVD
  22. Medium 4.9

    CVE-2016-5507 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.32 and earlier and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  23. Medium 5.3

    CVE-2016-5488 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.3.0 allows remote attackers to affect availability via vectors related to Web Container, a different vulnerability than CVE-2016-3445.

    Published 25 Oct 2016 · NVD
  24. Critical 9.8

    CVE-2016-3551 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle Web Services component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXWS Web Services Stack.

    Published 25 Oct 2016 · NVD
  25. High 8.8

    CVE-2016-3505 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.

    Published 25 Oct 2016 · NVD
  26. Medium 4.9

    CVE-2016-3495 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 25 Oct 2016 · NVD
  27. Medium 6.5

    CVE-2016-3492 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

    Published 25 Oct 2016 · Fixed in 5.5.52, 10.0.28, 10.1.18 · NVD
  28. Medium 4.3

    CVE-2016-0377 · IBM WebSphere Application Server

    The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

    Published 22 Oct 2016 · NVD
  29. High 7.5

    CVE-2016-2848 · BIND 9

    ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.

    Published 21 Oct 2016 · NVD
  30. Medium 5.9

    CVE-2016-7099 · Node.js

    The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

    Published 10 Oct 2016 · NVD
  31. Medium 6.1

    CVE-2016-5325 · Node.js

    CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

    Published 10 Oct 2016 · NVD
  32. Medium 6.3

    CVE-2016-7777 · Xen

    Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.

    Published 7 Oct 2016 · NVD
  33. Critical 9.8

    CVE-2016-7167 · curl

    Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

    Published 7 Oct 2016 · NVD
  34. High 7.5

    CVE-2016-6323 · GNU C Library

    The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.

    Published 7 Oct 2016 · NVD
  35. High 7.5

    CVE-2015-2080 · Eclipse Jetty

    The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

    Published 7 Oct 2016 · NVD
  36. Medium 6.5

    CVE-2016-6424 · Cisco ASA and Firepower Threat Defense

    The DHCP Relay implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4.7.29 and 9.1.7.4 allows remote attackers to cause a denial of service (interface wedge) via a crafted rate of DHCP packet transmission, aka Bug ID CSCuy66942.

    Published 6 Oct 2016 · NVD
  37. Critical 9.8

    CVE-2016-5745 · F5 BIG-IP

    F5 BIG-IP LTM systems 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system configuration files via vectors involving NAT64.

    Published 5 Oct 2016 · NVD
  38. High 7.5

    CVE-2016-5983 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object.

    Published 5 Oct 2016 · NVD
  39. High 7.5

    CVE-2016-7141 · curl

    curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

    Published 3 Oct 2016 · NVD
  40. Medium 4.3

    CVE-2016-7572 · Drupal

    The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.

    Published 3 Oct 2016 · NVD
  41. Medium 6.1

    CVE-2016-7571 · Drupal

    Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.

    Published 3 Oct 2016 · NVD
  42. Medium 4.3

    CVE-2016-7570 · Drupal

    Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

    Published 3 Oct 2016 · NVD
  43. Medium 5.5

    CVE-2016-6494 · MongoDB

    The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.

    Published 3 Oct 2016 · Fixed in 3.0.15, 3.2.14, 3.3.14 · NVD
  44. Medium 5.5

    CVE-2016-1372 · ClamAV

    ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.

    Published 3 Oct 2016 · NVD
  45. Medium 5.5

    CVE-2016-1371 · ClamAV

    ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.

    Published 3 Oct 2016 · NVD
  46. Critical 9.8

    CVE-2016-5700 · F5 BIG-IP

    Virtual servers in F5 BIG-IP systems 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2, when configured with the HTTP Explicit Proxy functionality or SOCKS profile, allow remote attackers to modify the system configuration, read system files, and possibly execute arbitrary code via unspecified vectors.

    Published 3 Oct 2016 · NVD
  47. Critical 9.8

    CVE-2016-5180 · c-ares, Node.js

    Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

    Published 3 Oct 2016 · Fixed in 0.10.48, 0.12.17, 4.6.1 · NVD
  48. Critical 9.8

    CVE-2016-4436 · Apache Struts

    Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

    Published 3 Oct 2016 · NVD
  49. High 7.8

    CVE-2016-1240 · Apache Tomcat

    The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS…

    Published 3 Oct 2016 · NVD
  50. High 7.5

    CVE-2016-5986 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, which allows remote attackers to obtain sensitive information via unspecified vectors.

    Published 1 Oct 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.