UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,006
Published in 7 days
1,100
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,006 vulnerabilities
  1. Medium 6.5

    CVE-2016-6170 · BIND 9

    ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via…

    Published 6 Jul 2016 · NVD
  2. High 7.5

    CVE-2016-4979 · Apache HTTP Server

    The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.

    Published 6 Jul 2016 · NVD
  3. Medium 5.9

    CVE-2016-1546 · Apache HTTP Server

    The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.

    Published 6 Jul 2016 · NVD
  4. Medium 6.1

    CVE-2016-5099 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding.

    Published 5 Jul 2016 · NVD
  5. Medium 5.3

    CVE-2016-5098 · phpMyAdmin

    Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.

    Published 5 Jul 2016 · NVD
  6. Medium 5.3

    CVE-2016-5097 · phpMyAdmin

    phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.

    Published 5 Jul 2016 · NVD
  7. Medium 5.3

    CVE-2016-4465 · Apache Struts

    The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

    Published 4 Jul 2016 · NVD
  8. Critical 9.8

    CVE-2016-4438 · Apache Struts

    The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

    Published 4 Jul 2016 · NVD
  9. High 7.5

    CVE-2016-4433 · Apache Struts

    Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

    Published 4 Jul 2016 · NVD
  10. High 7.5

    CVE-2016-4431 · Apache Struts

    Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

    Published 4 Jul 2016 · NVD
  11. High 8.8

    CVE-2016-4430 · Apache Struts

    Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

    Published 4 Jul 2016 · NVD
  12. High 7.5

    CVE-2016-3092 · Apache Tomcat

    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

    Published 4 Jul 2016 · NVD
  13. High 8.2

    CVE-2016-1182 · Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

    Published 4 Jul 2016 · NVD
  14. High 8.1

    CVE-2016-1181 · Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

    Published 4 Jul 2016 · NVD
  15. High 7.5

    CVE-2015-0899 · Apache Struts

    The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

    Published 4 Jul 2016 · NVD
  16. Medium 6.1

    CVE-2016-0359 · IBM WebSphere Application Server

    CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

    Published 3 Jul 2016 · NVD
  17. High 7.5

    CVE-2016-5739 · phpMyAdmin

    The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.

    Published 3 Jul 2016 · NVD
  18. Critical 9.8

    CVE-2016-5734 · phpMyAdmin

    phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.

    Published 3 Jul 2016 · NVD
  19. Medium 6.1

    CVE-2016-5733 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the…

    Published 3 Jul 2016 · NVD
  20. Medium 6.1

    CVE-2016-5732 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.

    Published 3 Jul 2016 · NVD
  21. Medium 6.1

    CVE-2016-5731 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.

    Published 3 Jul 2016 · NVD
  22. Medium 5.3

    CVE-2016-5730 · phpMyAdmin

    phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in…

    Published 3 Jul 2016 · NVD
  23. High 7.5

    CVE-2016-5706 · phpMyAdmin

    js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.

    Published 3 Jul 2016 · NVD
  24. Medium 6.1

    CVE-2016-5705 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group…

    Published 3 Jul 2016 · NVD
  25. Medium 6.1

    CVE-2016-5704 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment.

    Published 3 Jul 2016 · NVD
  26. Critical 9.8

    CVE-2016-5703 · phpMyAdmin

    SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.

    Published 3 Jul 2016 · NVD
  27. Low 3.7

    CVE-2016-5702 · phpMyAdmin

    phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.

    Published 3 Jul 2016 · NVD
  28. Medium 6.1

    CVE-2016-5701 · phpMyAdmin

    setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.

    Published 3 Jul 2016 · NVD
  29. Medium 6.1

    CVE-2015-6931 · VMware vCenter Server

    Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

    Published 3 Jul 2016 · NVD
  30. High 7.5

    CVE-2016-3956 · Node.js

    The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

    Published 2 Jul 2016 · NVD
  31. Unrated

    WPV-c3e670cbbc4c · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 1 Jul 2016 · Fixed in 2.3.7 · WPVulnerability
  32. High 7.5

    CVE-2016-5360 · HAProxy

    HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.

    Published 30 Jun 2016 · NVD
  33. High 8.8

    CVE-2016-5020 · F5 BIG-IP

    F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification (EAV) monitor script.

    Published 30 Jun 2016 · NVD
  34. High 8.8

    CVE-2016-4971 · Palo Alto Networks PAN-OS

    GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

    Published 30 Jun 2016 · NVD
  35. High 8.1

    CVE-2016-4472 · Expat, Python

    The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

    Published 30 Jun 2016 · Fixed in 3.4.7, 3.5.4, 3.6.2 · NVD
  36. Medium 6.5

    CVE-2016-3189 · Python

    Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

    Published 30 Jun 2016 · Fixed in 3.8.13, 3.9.11, 3.10.3 · NVD
  37. High 7.5

    CVE-2016-5839 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.

    Published 29 Jun 2016 · NVD
  38. High 7.5

    CVE-2016-5838 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.

    Published 29 Jun 2016 · NVD
  39. High 7.5

    CVE-2016-5837 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.

    Published 29 Jun 2016 · NVD
  40. High 7.5

    CVE-2016-5836 · WordPress

    The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

    Published 29 Jun 2016 · NVD
  41. High 7.5

    CVE-2016-5835 · WordPress

    WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.

    Published 29 Jun 2016 · NVD
  42. Medium 6.1

    CVE-2016-5834 · WordPress

    Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.

    Published 29 Jun 2016 · NVD
  43. Medium 6.1

    CVE-2016-5833 · WordPress

    Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.

    Published 29 Jun 2016 · NVD
  44. High 7.5

    CVE-2016-5832 · WordPress

    The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.

    Published 29 Jun 2016 · NVD
  45. Medium 4.9

    CVE-2016-5021 · F5 BIG-IP

    The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management…

    Published 24 Jun 2016 · NVD
  46. High 7.8

    CVE-2016-4802 · curl

    Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll, (2) secur32.dll, or (3) ws2_32.dll in the application or current working directory.

    Published 24 Jun 2016 · NVD
  47. Medium 5.5

    CVE-2016-2178 · Node.js, OpenSSL

    The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

    Published 20 Jun 2016 · Fixed in 0.12.16, 4.6.0, 6.7.0 · NVD
  48. Critical 9.8

    CVE-2016-2177 · OpenSSL

    OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

    Published 20 Jun 2016 · NVD
  49. Unrated

    WPV-beefcad79b61 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 20 Jun 2016 · Fixed in 4.0.4 · WPVulnerability
  50. Medium 6.1

    CVE-2016-10705 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 20 Jun 2016 · Fixed in 4.0.4 · NVD, WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.