UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,007
Published in 7 days
1,100
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,007 vulnerabilities
  1. Medium 5.5

    CVE-2016-0659 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Optimizer.

    Published 21 Apr 2016 · NVD
  2. Medium 5.5

    CVE-2016-0658 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Optimizer.

    Published 21 Apr 2016 · NVD
  3. Medium 5.5

    CVE-2016-0657 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect confidentiality via vectors related to JSON.

    Published 21 Apr 2016 · NVD
  4. Medium 5.5

    CVE-2016-0656 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability than CVE-2016-0654.

    Published 21 Apr 2016 · NVD
  5. Medium 4.7

    CVE-2016-0655 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to InnoDB.

    Published 21 Apr 2016 · Fixed in 10.0.25, 10.1.14 · NVD
  6. Medium 5.5

    CVE-2016-0654 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability than CVE-2016-0656.

    Published 21 Apr 2016 · NVD
  7. Medium 5.5

    CVE-2016-0653 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to FTS.

    Published 21 Apr 2016 · NVD
  8. Medium 5.5

    CVE-2016-0652 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to DML.

    Published 21 Apr 2016 · NVD
  9. Medium 5.5

    CVE-2016-0651 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

    Published 21 Apr 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  10. Medium 5.5

    CVE-2016-0650 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to Replication.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  11. Medium 5.5

    CVE-2016-0649 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to PS.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  12. Medium 5.5

    CVE-2016-0648 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to PS.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  13. Medium 5.5

    CVE-2016-0647 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to FTS.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  14. Medium 5.5

    CVE-2016-0646 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DML.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  15. Medium 5.5

    CVE-2016-0644 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DDL.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  16. Low 3.3

    CVE-2016-0643 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML.

    Published 21 Apr 2016 · Fixed in 5.5.49, 10.0.25, 10.1.14 · NVD
  17. Medium 4.7

    CVE-2016-0642 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.

    Published 21 Apr 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  18. Medium 5.1

    CVE-2016-0641 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect confidentiality and availability via vectors related to MyISAM.

    Published 21 Apr 2016 · Fixed in 10.0.24, 10.1.12 · NVD
  19. Medium 6.1

    CVE-2016-0640 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect integrity and availability via vectors related to DML.

    Published 21 Apr 2016 · Fixed in 5.5.48, 10.0.24, 10.1.12 · NVD
  20. Critical 9.8

    CVE-2016-0639 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Pluggable Authentication.

    Published 21 Apr 2016 · NVD
  21. Critical 9.8

    CVE-2016-0638 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.

    Published 21 Apr 2016 · NVD
  22. High 7.5

    CVE-2015-6360 · Cisco ASA and Firepower Threat Defense

    The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.

    Published 21 Apr 2016 · NVD
  23. Medium 5.9

    CVE-2016-2390 · Squid

    The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.

    Published 19 Apr 2016 · NVD
  24. Critical 9.8

    CVE-2015-8779 · GNU C Library

    Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.

    Published 19 Apr 2016 · NVD
  25. Critical 9.8

    CVE-2015-8778 · GNU C Library

    Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.

    Published 19 Apr 2016 · NVD
  26. Critical 9.1

    CVE-2015-8776 · GNU C Library

    The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.

    Published 19 Apr 2016 · NVD
  27. Critical 9.8

    CVE-2014-9761 · GNU C Library

    Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.

    Published 19 Apr 2016 · NVD
  28. Medium 5.5

    CVE-2016-3961 · Xen

    Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.

    Published 15 Apr 2016 · NVD
  29. Medium 5.3

    CVE-2016-2212 · Magento / Adobe Commerce

    The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status.

    Published 15 Apr 2016 · NVD
  30. High 7.6

    CVE-2016-2076 · VMware vCenter Server

    Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site.

    Published 15 Apr 2016 · NVD
  31. High 7.5

    CVE-2015-8554 · Xen

    Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path."

    Published 14 Apr 2016 · NVD
  32. High 7.5

    CVE-2015-8806 · libxml2

    dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

    Published 13 Apr 2016 · Fixed in 2.9.4 · NVD
  33. Medium 5.9

    CVE-2016-3686 · F5 BIG-IP

    The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote attackers to obtain sensitive SessionId information by leveraging access to the Location HTTP header in a redirect.

    Published 13 Apr 2016 · NVD
  34. Low 3.8

    CVE-2016-3159 · Xen

    The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

    Published 13 Apr 2016 · NVD
  35. Low 3.8

    CVE-2016-3158 · Xen

    The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

    Published 13 Apr 2016 · NVD
  36. High 7.4

    CVE-2016-2084 · F5 BIG-IP

    F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256, 11.6.0 before build 6.204.442, and 12.0.0 before build 1.14.628; BIG-IP AAM 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256, 11.6.0 before build 6.204.442, and…

    Published 13 Apr 2016 · NVD
  37. Medium 6.1

    CVE-2015-8606 · Silverstripe CMS

    Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.

    Published 13 Apr 2016 · NVD
  38. High 8.6

    CVE-2015-8555 · Xen

    Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

    Published 13 Apr 2016 · NVD
  39. Medium 4.4

    CVE-2015-8552 · Xen

    The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux…

    Published 13 Apr 2016 · NVD
  40. High 7.5

    CVE-2016-2118 · Samba

    The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

    Published 12 Apr 2016 · Fixed in 4.2.10, 4.3.7, 4.4.1 · NVD
  41. Critical 9.8

    CVE-2016-3657 · Palo Alto Networks PAN-OS

    Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.

    Published 12 Apr 2016 · Fixed in 5.1.11, 6.0.13, 6.1.10 · NVD
  42. High 7.5

    CVE-2016-3656 · Palo Alto Networks PAN-OS

    The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service (service crash) via a crafted request.

    Published 12 Apr 2016 · Fixed in 5.1.11, 6.0.13, 6.1.10 · NVD
  43. Critical 9.8

    CVE-2016-3655 · Palo Alto Networks PAN-OS

    The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.

    Published 12 Apr 2016 · Fixed in 5.1.11, 6.0.13, 6.1.10 · NVD
  44. High 7.2

    CVE-2016-3654 · Palo Alto Networks PAN-OS

    The device management command line interface (CLI) in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.

    Published 12 Apr 2016 · Fixed in 5.1.11, 6.0.13, 6.1.10 · NVD
  45. Medium 6.1

    CVE-2016-4003 · Apache Struts

    Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

    Published 12 Apr 2016 · NVD
  46. High 7.8

    CVE-2016-3157 · Xen

    The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.

    Published 12 Apr 2016 · NVD
  47. Medium 6.1

    CVE-2016-2162 · Apache Struts

    Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

    Published 12 Apr 2016 · NVD
  48. High 8.8

    CVE-2016-0785 · Apache Struts

    Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.

    Published 12 Apr 2016 · Fixed in 2.3.20.3 · NVD
  49. High 8.1

    CVE-2016-3171 · Drupal

    Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.

    Published 12 Apr 2016 · NVD
  50. Medium 5.3

    CVE-2016-3170 · Drupal

    The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.

    Published 12 Apr 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.