UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,007
Published in 7 days
1,100
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,007 vulnerabilities
  1. Medium 5.5Actively exploited

    CVE-2016-3718 · ImageMagick

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

    Published 5 May 2016 · Fixed in 6.9.3-10 · NVD
  2. Medium 5.5

    CVE-2016-3717 · ImageMagick

    The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.

    Published 5 May 2016 · NVD
  3. Low 3.3

    CVE-2016-3716 · ImageMagick

    The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.

    Published 5 May 2016 · NVD
  4. Medium 5.5Actively exploited

    CVE-2016-3715 · ImageMagick

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

    Published 5 May 2016 · Fixed in 6.9.3-10 · NVD
  5. High 8.4Actively exploited

    CVE-2016-3714 · ImageMagick

    The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

    Published 5 May 2016 · NVD
  6. High 8.2

    CVE-2016-2176 · OpenSSL

    The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

    Published 5 May 2016 · NVD
  7. High 7.5

    CVE-2016-2109 · OpenSSL

    The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

    Published 5 May 2016 · NVD
  8. Critical 9.8

    CVE-2016-2108 · OpenSSL

    The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

    Published 5 May 2016 · NVD
  9. Medium 5.9

    CVE-2016-2107 · Node.js, OpenSSL

    The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

    Published 5 May 2016 · Fixed in 0.12.14, 4.4.4, 5.11.1 · NVD
  10. High 7.5

    CVE-2016-2106 · OpenSSL

    Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

    Published 5 May 2016 · NVD
  11. High 7.5

    CVE-2016-2105 · Node.js, OpenSSL, MySQL

    Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

    Published 5 May 2016 · Fixed in 0.12.14, 4.4.4, 5.11.1 · NVD
  12. High 7.5

    CVE-2000-1254 · OpenSSL

    crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms.

    Published 5 May 2016 · NVD
  13. High 7.8

    CVE-2015-8325 · OpenSSH

    The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.

    Published 1 May 2016 · NVD
  14. Critical 9.8

    CVE-2016-3082 · Apache Struts

    XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.

    Published 26 Apr 2016 · NVD
  15. High 8.1Actively exploited

    CVE-2016-3081 · Apache Struts

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

    Published 26 Apr 2016 · Fixed in 2.3.20.3, 2.3.24.3, 2.3.28.1 · NVD
  16. Critical 9.8

    CVE-2016-3074 · PHP

    Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

    Published 26 Apr 2016 · Fixed in 5.5.35, 5.6.21, 7.0.6 · NVD
  17. High 8.1

    CVE-2016-4054 · Squid

    Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.

    Published 25 Apr 2016 · NVD
  18. Low 3.7

    CVE-2016-4053 · Squid

    Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.

    Published 25 Apr 2016 · NVD
  19. High 8.1

    CVE-2016-4052 · Squid

    Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.

    Published 25 Apr 2016 · NVD
  20. High 8.8

    CVE-2016-4051 · Squid

    Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.

    Published 25 Apr 2016 · NVD
  21. High 7.5

    CVE-2015-8852 · Varnish Cache

    Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.

    Published 25 Apr 2016 · NVD
  22. Medium 5.9

    CVE-2016-2115 · Samba

    Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.

    Published 25 Apr 2016 · NVD
  23. Medium 5.9

    CVE-2016-2114 · Samba

    The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.

    Published 25 Apr 2016 · NVD
  24. High 7.4

    CVE-2016-2113 · Samba

    Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.

    Published 25 Apr 2016 · NVD
  25. Medium 5.9

    CVE-2016-2112 · Samba

    The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

    Published 25 Apr 2016 · NVD
  26. Medium 6.3

    CVE-2016-2111 · Samba

    The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.

    Published 25 Apr 2016 · NVD
  27. Medium 5.9

    CVE-2016-2110 · Samba

    The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP…

    Published 25 Apr 2016 · NVD
  28. Medium 5.9

    CVE-2015-5370 · Samba

    Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.

    Published 25 Apr 2016 · NVD
  29. High 8.3

    CVE-2016-3449 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.

    Published 21 Apr 2016 · NVD
  30. Critical 9.6

    CVE-2016-3443 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data, which triggers an…

    Published 21 Apr 2016 · NVD
  31. Critical 9.8Actively exploited

    CVE-2016-3427 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

    Published 21 Apr 2016 · NVD
  32. Low 3.1

    CVE-2016-3426 · Java

    Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE.

    Published 21 Apr 2016 · NVD
  33. Medium 4.3

    CVE-2016-3425 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP.

    Published 21 Apr 2016 · NVD
  34. Medium 4.3

    CVE-2016-3422 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect availability via vectors related to 2D.

    Published 21 Apr 2016 · NVD
  35. Medium 6.1

    CVE-2016-3416 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality and integrity via vectors related to Console.

    Published 21 Apr 2016 · NVD
  36. High 7.5

    CVE-2016-1367 · Cisco ASA and Firepower Threat Defense

    The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets, aka Bug ID CSCus23248.

    Published 21 Apr 2016 · NVD
  37. Medium 6.1

    CVE-2016-0700 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0675.

    Published 21 Apr 2016 · NVD
  38. Medium 5.4

    CVE-2016-0696 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6 allows remote attackers to affect confidentiality and integrity via vectors related to Console.

    Published 21 Apr 2016 · NVD
  39. Medium 5.9

    CVE-2016-0695 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

    Published 21 Apr 2016 · NVD
  40. Low 3.7

    CVE-2016-0688 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to Core Components.

    Published 21 Apr 2016 · NVD
  41. Critical 9.6

    CVE-2016-0687 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.

    Published 21 Apr 2016 · NVD
  42. Critical 9.6

    CVE-2016-0686 · Java

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.

    Published 21 Apr 2016 · NVD
  43. Medium 6.1

    CVE-2016-0675 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0700.

    Published 21 Apr 2016 · NVD
  44. Medium 4.1

    CVE-2016-0668 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

    Published 21 Apr 2016 · Fixed in 10.0.24 · NVD
  45. Medium 4.4

    CVE-2016-0667 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Locking.

    Published 21 Apr 2016 · NVD
  46. Medium 5.5

    CVE-2016-0666 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  47. Medium 5.5

    CVE-2016-0665 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Security: Encryption.

    Published 21 Apr 2016 · NVD
  48. Medium 4.7

    CVE-2016-0663 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Performance Schema.

    Published 21 Apr 2016 · NVD
  49. Medium 5.5

    CVE-2016-0662 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Partition.

    Published 21 Apr 2016 · NVD
  50. Medium 4.7

    CVE-2016-0661 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options.

    Published 21 Apr 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.