Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,940
- Published in 7 days
- 1,034
- Critical in 30 days
- 361
- Actively exploited
- 423
Latest vulnerabilities
39,940 vulnerabilities- Medium 5.4
CVE-2016-3042 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients.
Published 1 Oct 2016 · NVD - Critical 9.8
CVE-2016-7568 · PHP
Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
Published 28 Sept 2016 · NVD - High 7.5
CVE-2016-2776 · BIND 9
buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
Published 28 Sept 2016 · NVD - High 7.2
CVE-2016-4978 · Apache ActiveMQ Artemis
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Published 27 Sept 2016 · Fixed in 1.4.0 · NVD - Unrated
WPV-d05a451389f7 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Unrated
WPV-c088b8f02483 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Unrated
WPV-bf344bf3a262 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Unrated
WPV-4cd16c8377a3 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - High 7.5
CVE-2016-7052 · Node.js, OpenSSL
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.
Published 26 Sept 2016 · Fixed in 4.6.0, 6.7.0 · NVD - Critical 9.8
CVE-2016-6309 · OpenSSL
statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.
Published 26 Sept 2016 · NVD - Medium 5.9
CVE-2016-6308 · OpenSSL
statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted DTLS messages.
Published 26 Sept 2016 · NVD - Medium 5.9
CVE-2016-6307 · OpenSSL
The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted TLS messages, related to statem/statem.c and statem/statem_lib.c.
Published 26 Sept 2016 · NVD - Medium 5.9
CVE-2016-6306 · Node.js, OpenSSL
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
Published 26 Sept 2016 · Fixed in 0.12.16, 4.6.0, 6.7.0 · NVD - High 7.5
CVE-2016-6305 · OpenSSL
The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.
Published 26 Sept 2016 · NVD - High 7.5
CVE-2016-6304 · Node.js, OpenSSL
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
Published 26 Sept 2016 · Fixed in 0.12.16, 4.6.0, 6.7.0 · NVD - Medium 5.9
CVE-2016-6153 · SQLite
os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
Published 26 Sept 2016 · NVD - Unrated
WPV-adb039f25864 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Unrated
WPV-8fde612f0730 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Unrated
WPV-4eb9434d7a35 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Unrated
WPV-4b1b785cdfa0 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Unrated
WPV-2ee9c58fe403 · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability - Medium 6.5
CVE-2016-5172 · Node.js
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.
Published 25 Sept 2016 · NVD - Critical 9.8
CVE-2016-4658 · libxml2
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Published 25 Sept 2016 · Fixed in 2.9.5 · NVD - Medium 6.7
CVE-2016-7154 · Xen
Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number.
Published 21 Sept 2016 · NVD - Medium 4.1
CVE-2016-7094 · Xen
Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.
Published 21 Sept 2016 · NVD - High 8.2
CVE-2016-7093 · Xen
Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.
Published 21 Sept 2016 · NVD - Critical 9.8
CVE-2016-6662 · MariaDB, MySQL
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE:…
Published 20 Sept 2016 · Fixed in 5.5.51, 10.0.27, 10.1.17 · NVD - Medium 5.4
CVE-2016-7419 · Nextcloud
Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.
Published 17 Sept 2016 · NVD - High 7.5
CVE-2016-7418 · PHP
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.
Published 17 Sept 2016 · NVD - Critical 9.8
CVE-2016-7417 · PHP
ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.
Published 17 Sept 2016 · NVD - High 7.5
CVE-2016-7416 · PHP
ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.
Published 17 Sept 2016 · NVD - Critical 9.8
CVE-2016-7414 · PHP
The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.
Published 17 Sept 2016 · NVD - Critical 9.8
CVE-2016-7413 · PHP
Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.
Published 17 Sept 2016 · NVD - High 8.1
CVE-2016-7412 · PHP
ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted field metadata.
Published 17 Sept 2016 · NVD - Critical 9.8
CVE-2016-7411 · PHP
ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.
Published 17 Sept 2016 · NVD - Critical 9.8
CVE-2016-6303 · Node.js, OpenSSL
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
Published 16 Sept 2016 · Fixed in 0.12.16, 4.6.0, 6.6.0 · NVD - High 7.5
CVE-2016-6302 · OpenSSL
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.
Published 16 Sept 2016 · NVD - Critical 9.8
CVE-2016-2182 · OpenSSL
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
Published 16 Sept 2016 · NVD - High 7.5
CVE-2016-2181 · OpenSSL
The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.
Published 16 Sept 2016 · NVD - High 7.5
CVE-2016-2179 · OpenSSL
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.
Published 16 Sept 2016 · NVD - Medium 6.1
CVE-2016-3379 · Microsoft Exchange Server
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."
Published 14 Sept 2016 · NVD - High 7.4
CVE-2016-3378 · Microsoft Exchange Server
Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Microsoft Exchange Open Redirect Vulnerability."
Published 14 Sept 2016 · NVD - Medium 4.3
CVE-2016-0138 · Microsoft Exchange Server
Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."
Published 14 Sept 2016 · NVD - Critical 9.8
CVE-2016-7134 · PHP
ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and heap-based buffer overflow) or possibly have unspecified other impact via a long string that is mishandled in a curl_escape call.
Published 12 Sept 2016 · NVD - High 8.1
CVE-2016-7133 · PHP
Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.
Published 12 Sept 2016 · NVD - High 7.5
CVE-2016-7132 · PHP
ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.
Published 12 Sept 2016 · NVD - High 7.5
CVE-2016-7131 · PHP
ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.
Published 12 Sept 2016 · NVD - High 7.5
CVE-2016-7130 · PHP
The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.
Published 12 Sept 2016 · NVD - Critical 9.8
CVE-2016-7129 · PHP
The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.
Published 12 Sept 2016 · NVD - Medium 5.3
CVE-2016-7128 · PHP
The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.
Published 12 Sept 2016 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.