UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,940
Published in 7 days
1,034
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,940 vulnerabilities
  1. High 7.7

    CVE-2016-3503 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

    Published 21 Jul 2016 · NVD
  2. Medium 6.5

    CVE-2016-3501 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

    Published 21 Jul 2016 · NVD
  3. Medium 5.3

    CVE-2016-3500 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508.

    Published 21 Jul 2016 · NVD
  4. Critical 9.8

    CVE-2016-3499 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3.0 and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Web Container.

    Published 21 Jul 2016 · NVD
  5. Medium 5.3

    CVE-2016-3498 · Java

    Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows remote attackers to affect availability via vectors related to JavaFX.

    Published 21 Jul 2016 · NVD
  6. Medium 6.5

    CVE-2016-3486 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: FTS.

    Published 21 Jul 2016 · NVD
  7. Low 2.9

    CVE-2016-3485 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking.

    Published 21 Jul 2016 · NVD
  8. High 8.1

    CVE-2016-3477 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser.

    Published 21 Jul 2016 · Fixed in 5.5.50, 10.0.26, 10.1.15 · NVD
  9. High 7.5

    CVE-2016-3471 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.45 and earlier and 5.6.26 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Option.

    Published 21 Jul 2016 · Fixed in 5.5.46, 10.0.22, 10.1.9 · NVD
  10. Medium 4.9

    CVE-2016-3459 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows remote administrators to affect availability via vectors related to Server: InnoDB.

    Published 21 Jul 2016 · Fixed in 10.0.25, 10.1.14 · NVD
  11. Medium 4.3

    CVE-2016-3458 · Java

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA.

    Published 21 Jul 2016 · NVD
  12. Low 3.7

    CVE-2016-3452 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption.

    Published 21 Jul 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  13. Medium 5.3

    CVE-2016-3445 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.3.0 allows remote attackers to affect availability via vectors related to Web Container, a different vulnerability than CVE-2016-5488.

    Published 21 Jul 2016 · NVD
  14. High 7.7

    CVE-2016-3440 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

    Published 21 Jul 2016 · NVD
  15. Medium 4.9

    CVE-2016-3424 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer.

    Published 21 Jul 2016 · NVD
  16. Unrated

    WPV-7e9742981174 · WooCommerce

    Vulnerability in WooCommerce

    Published 20 Jul 2016 · Fixed in 2.6.3 · WPVulnerability
  17. Medium 5.9

    CVE-2016-2775 · BIND 9

    ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

    Published 19 Jul 2016 · NVD
  18. High 8.1

    CVE-2016-5388 · Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an…

    Published 19 Jul 2016 · NVD
  19. High 8.1

    CVE-2016-5387 · Apache HTTP Server

    The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the…

    Published 19 Jul 2016 · NVD
  20. High 8.1

    CVE-2016-5385 · Drupal, PHP

    PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by…

    Published 19 Jul 2016 · Fixed in 5.5.38, 5.6.24, 8.1.7 · NVD
  21. Unrated

    WPV-85317a68f1e8 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 19 Jul 2016 · Fixed in 2.3.8 · WPVulnerability
  22. Unrated

    WPV-64d7067d0d7a · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 19 Jul 2016 · Fixed in 2.3.7 · WPVulnerability
  23. Unrated

    WPV-412b3bf50cb5 · WooCommerce

    Vulnerability in WooCommerce

    Published 19 Jul 2016 · Fixed in 2.6.3 · WPVulnerability
  24. Medium 4.9

    CVE-2016-5092 · Fortinet FortiWeb

    Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privileges to read arbitrary files by leveraging the autolearn feature.

    Published 13 Jul 2016 · NVD
  25. High 8.8

    CVE-2016-4066 · Fortinet FortiWeb

    Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for requests that change the password via unspecified vectors.

    Published 13 Jul 2016 · NVD
  26. Unrated

    WPV-eeb64da477e4 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 13 Jul 2016 · Fixed in 2.3.8 · WPVulnerability
  27. High 8.1

    CVE-2016-6174 · PHP

    applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.

    Published 12 Jul 2016 · NVD
  28. Medium 5.4

    CVE-2016-2219 · Palo Alto Networks PAN-OS

    Cross-site scripting (XSS) vulnerability in the management interface in Palo Alto Networks PAN-OS 7.x before 7.0.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

    Published 12 Jul 2016 · NVD
  29. Medium 5.3

    CVE-2016-1445 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliance (ASA) Software 8.2 through 9.4.3.3 allows remote attackers to bypass intended ICMP Echo Reply ACLs via vectors related to subtypes.

    Published 12 Jul 2016 · Fixed in 9.5.2.10, 9.6.1.5 · NVD
  30. Unrated

    WPV-6a93a8c702ad · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 11 Jul 2016 · Fixed in 2.3.6.2 · WPVulnerability
  31. High 7.5

    CVE-2016-2945 · IBM WebSphere Application Server

    The API Discovery implementation in IBM WebSphere Application Server (WAS) 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document.

    Published 8 Jul 2016 · NVD
  32. High 7.5

    CVE-2016-2119 · Samba

    libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag.

    Published 7 Jul 2016 · Fixed in 4.2.14, 4.3.11, 4.4.5 · NVD
  33. High 7.5

    CVE-2016-2923 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

    Published 7 Jul 2016 · NVD
  34. Medium 5.3

    CVE-2016-0389 · IBM WebSphere Application Server

    Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.

    Published 7 Jul 2016 · NVD
  35. Medium 6.5

    CVE-2016-6170 · BIND 9

    ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via…

    Published 6 Jul 2016 · NVD
  36. High 7.5

    CVE-2016-4979 · Apache HTTP Server

    The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.

    Published 6 Jul 2016 · NVD
  37. Medium 5.9

    CVE-2016-1546 · Apache HTTP Server

    The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.

    Published 6 Jul 2016 · NVD
  38. Medium 6.1

    CVE-2016-5099 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding.

    Published 5 Jul 2016 · NVD
  39. Medium 5.3

    CVE-2016-5098 · phpMyAdmin

    Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.

    Published 5 Jul 2016 · NVD
  40. Medium 5.3

    CVE-2016-5097 · phpMyAdmin

    phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.

    Published 5 Jul 2016 · NVD
  41. Medium 5.3

    CVE-2016-4465 · Apache Struts

    The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

    Published 4 Jul 2016 · NVD
  42. Critical 9.8

    CVE-2016-4438 · Apache Struts

    The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

    Published 4 Jul 2016 · NVD
  43. High 7.5

    CVE-2016-4433 · Apache Struts

    Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

    Published 4 Jul 2016 · NVD
  44. High 7.5

    CVE-2016-4431 · Apache Struts

    Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

    Published 4 Jul 2016 · NVD
  45. High 8.8

    CVE-2016-4430 · Apache Struts

    Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

    Published 4 Jul 2016 · NVD
  46. High 7.5

    CVE-2016-3092 · Apache Tomcat

    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

    Published 4 Jul 2016 · NVD
  47. High 8.2

    CVE-2016-1182 · Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

    Published 4 Jul 2016 · NVD
  48. High 8.1

    CVE-2016-1181 · Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

    Published 4 Jul 2016 · NVD
  49. High 7.5

    CVE-2015-0899 · Apache Struts

    The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

    Published 4 Jul 2016 · NVD
  50. Medium 6.1

    CVE-2016-0359 · IBM WebSphere Application Server

    CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

    Published 3 Jul 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.