UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,006
Published in 7 days
1,100
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,006 vulnerabilities
  1. High 7.5

    CVE-2016-5300 · Expat

    The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.

    Published 16 Jun 2016 · Fixed in 2.2.0 · NVD
  2. Medium 5.3

    CVE-2016-3687 · F5 BIG-IP

    Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-on (SSO), allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in the SSO_ORIG_URI parameter.

    Published 16 Jun 2016 · NVD
  3. High 8.8

    CVE-2016-3062 · FFmpeg

    The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.

    Published 16 Jun 2016 · NVD
  4. Medium 5.9

    CVE-2012-6702 · Expat

    Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.

    Published 16 Jun 2016 · Fixed in 2.2.0 · NVD
  5. Medium 6.1

    CVE-2016-4159 · Adobe ColdFusion

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 16 Jun 2016 · NVD
  6. Unrated

    WPV-fb264eab4f92 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 14 Jun 2016 · Fixed in 3.3.0 · WPVulnerability
  7. Unrated

    WPV-7f2619adec9d · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 14 Jun 2016 · Fixed in 3.3.0 · WPVulnerability
  8. Medium 6.1

    CVE-2016-3670 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.

    Published 13 Jun 2016 · NVD
  9. Critical 9.8

    CVE-2016-5118 · ImageMagick

    The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

    Published 10 Jun 2016 · Fixed in 7.0.1-7 · NVD
  10. Medium 5.9

    CVE-2016-4429 · GNU C Library

    Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.

    Published 10 Jun 2016 · Fixed in 2.24 · NVD
  11. High 7.5

    CVE-2016-3706 · GNU C Library

    Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.

    Published 10 Jun 2016 · Fixed in 2.23 · NVD
  12. High 7.1

    CVE-2016-4449 · libxml2

    XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

    Published 9 Jun 2016 · NVD
  13. Critical 9.8

    CVE-2016-4448 · libxml2

    Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

    Published 9 Jun 2016 · NVD
  14. High 7.5

    CVE-2016-4447 · libxml2

    The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.

    Published 9 Jun 2016 · NVD
  15. Medium 5.5

    CVE-2016-1582 · LXD

    LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.

    Published 9 Jun 2016 · NVD
  16. Medium 5.5

    CVE-2016-1581 · LXD

    LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary containers via unspecified vectors.

    Published 9 Jun 2016 · NVD
  17. Medium 6.1

    CVE-2016-2078 · VMware vCenter Server

    Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter.

    Published 8 Jun 2016 · NVD
  18. High 7.5

    CVE-2016-1405 · ClamAV

    libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503.

    Published 8 Jun 2016 · NVD
  19. High 7.5

    CVE-2016-4545 · F5 BIG-IP

    Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service (resource consumption and Traffic Management Microkernel restart) via an SSL alert during the handshake.

    Published 7 Jun 2016 · NVD
  20. Medium 5.3

    CVE-2016-3093 · Apache Struts

    Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

    Published 7 Jun 2016 · NVD
  21. Critical 9.8

    CVE-2016-3087 · Apache Struts

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

    Published 7 Jun 2016 · NVD
  22. Medium 5.9

    CVE-2013-7440 · Python

    The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

    Published 7 Jun 2016 · NVD
  23. Medium 5.6

    CVE-2016-5242 · Xen

    The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion.

    Published 7 Jun 2016 · NVD
  24. Medium 4.7

    CVE-2016-4963 · Xen

    The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.

    Published 7 Jun 2016 · NVD
  25. Medium 6.7

    CVE-2016-4962 · Xen

    The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.

    Published 7 Jun 2016 · NVD
  26. High 7.5

    CVE-2016-4450 · nginx

    os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

    Published 7 Jun 2016 · Fixed in 1.10.1 · NVD
  27. Critical 9.1

    CVE-2015-5041 · IBM WebSphere Application Server

    The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.

    Published 6 Jun 2016 · NVD
  28. Critical 9.8

    CVE-2016-4564 · ImageMagick

    The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

    Published 4 Jun 2016 · NVD
  29. High 8.8

    CVE-2016-4563 · ImageMagick

    The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles the relationship between the BezierQuantum value and certain strokes data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

    Published 4 Jun 2016 · NVD
  30. High 8.8

    CVE-2016-4562 · ImageMagick

    The DrawDashPolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

    Published 4 Jun 2016 · NVD
  31. High 7.8

    CVE-2016-3697 · Docker Engine, runc

    libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

    Published 1 Jun 2016 · NVD
  32. Critical 9.8Actively exploited

    CVE-2016-3088 · Apache ActiveMQ

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

    Published 1 Jun 2016 · Fixed in 5.14.0 · NVD
  33. High 7.5

    CVE-2016-3075 · GNU C Library

    Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.

    Published 1 Jun 2016 · NVD
  34. High 7.5

    CVE-2016-1234 · GNU C Library

    Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.

    Published 1 Jun 2016 · Fixed in 2.24 · NVD
  35. Medium 6.5

    CVE-2016-1379 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliance (ASA) Software 9.0 through 9.5.1 mishandles IPsec error processing, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted (1) LAN-to-LAN or (2) Remote Access VPN tunnel packets, aka Bug ID CSCuv70576.

    Published 28 May 2016 · NVD
  36. Critical 9.8

    CVE-2016-0718 · Expat, Python

    Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

    Published 26 May 2016 · Fixed in 3.4.7, 3.5.4, 3.6.2 · NVD
  37. Medium 6.5

    CVE-2016-1385 · Cisco ASA and Firepower Threat Defense

    The XML parser in Cisco Adaptive Security Appliance (ASA) Software through 9.5.2 allows remote authenticated users to cause a denial of service (instability, memory consumption, or device reload) by leveraging (1) administrative access or (2) Clientless SSL VPN access to provide a crafted XML document, aka Bug ID CSCut14209.

    Published 26 May 2016 · NVD
  38. Medium 5.3

    CVE-2016-4792 · Ivanti Connect Secure

    Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors.

    Published 26 May 2016 · NVD
  39. High 8.6

    CVE-2016-4791 · Ivanti Connect Secure

    The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.

    Published 26 May 2016 · NVD
  40. Medium 5.5

    CVE-2016-4790 · Ivanti Connect Secure

    Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 26 May 2016 · NVD
  41. Medium 6.1

    CVE-2016-4789 · Ivanti Connect Secure

    Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 26 May 2016 · NVD
  42. Medium 5.8

    CVE-2016-4788 · Ivanti Connect Secure

    Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors.

    Published 26 May 2016 · NVD
  43. Critical 10.0

    CVE-2016-4787 · Ivanti Connect Secure

    Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.

    Published 26 May 2016 · NVD
  44. High 7.5

    CVE-2016-4786 · Ivanti Connect Secure

    Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

    Published 26 May 2016 · NVD
  45. Unrated

    WPV-cc4617da308d · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 26 May 2016 · Fixed in 4.0.3 · WPVulnerability
  46. Medium 6.5

    CVE-2014-3672 · Xen

    The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.

    Published 25 May 2016 · NVD
  47. Medium 5.3

    CVE-2016-2190 · Moodle

    Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

    Published 22 May 2016 · NVD
  48. Medium 4.3

    CVE-2016-2159 · Moodle

    The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service request.

    Published 22 May 2016 · NVD
  49. Medium 4.3

    CVE-2016-2158 · Moodle

    lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.

    Published 22 May 2016 · NVD
  50. High 8.8

    CVE-2016-2157 · Moodle

    Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.

    Published 22 May 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.