Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 40,007
- Published in 7 days
- 1,100
- Critical in 30 days
- 386
- Actively exploited
- 423
Latest vulnerabilities
40,007 vulnerabilities- Medium 5.4
CVE-2016-2043 · phpMyAdmin
Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.
Published 20 Feb 2016 · NVD - Medium 5.3
CVE-2016-2042 · phpMyAdmin
phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.
Published 20 Feb 2016 · NVD - High 7.5
CVE-2016-2041 · phpMyAdmin
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.
Published 20 Feb 2016 · NVD - Medium 5.4
CVE-2016-2040 · phpMyAdmin
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
Published 20 Feb 2016 · NVD - Medium 5.3
CVE-2016-2039 · phpMyAdmin
libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.
Published 20 Feb 2016 · NVD - Medium 5.3
CVE-2016-2038 · phpMyAdmin
phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Published 20 Feb 2016 · NVD - High 7.5
CVE-2016-1927 · phpMyAdmin
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.
Published 20 Feb 2016 · NVD - Medium 5.5
CVE-2016-2271 · Xen
VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.
Published 19 Feb 2016 · NVD - Medium 6.8
CVE-2016-2270 · Xen
Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.
Published 19 Feb 2016 · NVD - High 8.1
CVE-2015-7547 · F5 BIG-IP, GNU C Library
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to…
Published 18 Feb 2016 · NVD - High 7.5
CVE-2016-0773 · PostgreSQL
PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.
Published 17 Feb 2016 · NVD - High 8.8
CVE-2016-0766 · PostgreSQL
PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.
Published 17 Feb 2016 · Fixed in 9.2.15, 9.3.11, 9.4.6 · NVD - Medium 5.3
CVE-2016-0747 · nginx
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
Published 15 Feb 2016 · Fixed in 1.8.1, 1.9.10 · NVD - Critical 9.8
CVE-2016-0746 · nginx
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
Published 15 Feb 2016 · Fixed in 1.9.10 · NVD - High 7.5
CVE-2016-0742 · nginx
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
Published 15 Feb 2016 · Fixed in 1.8.1, 1.9.10 · NVD - Low 3.7
CVE-2016-0701 · OpenSSL
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
Published 15 Feb 2016 · NVD - Medium 6.1
CVE-2015-8797 · Apache Solr
Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
Published 15 Feb 2016 · NVD - Medium 6.1
CVE-2015-8796 · Apache Solr
Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.
Published 15 Feb 2016 · NVD - Medium 6.1
CVE-2015-8795 · Apache Solr
Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.
Published 15 Feb 2016 · NVD - Medium 5.9
CVE-2015-3197 · OpenSSL
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
Published 15 Feb 2016 · NVD - Medium 6.5
CVE-2016-2073 · libxml2
The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document.
Published 12 Feb 2016 · Fixed in 2.9.4 · NVD - High 8.8
CVE-2016-2330 · FFmpeg
libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file, related to the gif_image_write_image, gif_encode_init, and gif_encode_close functions.
Published 12 Feb 2016 · NVD - High 8.8
CVE-2016-2329 · FFmpeg
libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiff_decode_tag and decode_frame functions.
Published 12 Feb 2016 · NVD - High 8.8
CVE-2016-2328 · FFmpeg
libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values, which allows remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file, related to the bayer_to_rgb24_wrapper and bayer_to_yv12_wrapper functions.
Published 12 Feb 2016 · NVD - High 8.8
CVE-2016-2327 · FFmpeg
libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .avi file, related to the apng_encode_frame and encode_apng functions.
Published 12 Feb 2016 · NVD - High 8.8
CVE-2016-2326 · FFmpeg
Integer overflow in the asf_write_packet function in libavformat/asfenc.c in FFmpeg before 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS (aka presentation timestamp) value in a .mov file.
Published 12 Feb 2016 · NVD - Critical 9.8
CVE-2016-1287 · Cisco ASA and Firepower Threat Defense
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual…
Published 11 Feb 2016 · NVD - High 7.5
CVE-2016-0958 · Adobe Experience Manager
Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 might allow remote attackers to have an unspecified impact via a crafted serialized Java object.
Published 10 Feb 2016 · NVD - High 7.5
CVE-2016-0957 · Adobe Experience Manager
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.
Published 10 Feb 2016 · NVD - High 7.5
CVE-2016-0956 · Adobe Experience Manager
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
Published 10 Feb 2016 · NVD - Medium 6.1
CVE-2016-0955 · Adobe Experience Manager
Cross-site scripting (XSS) vulnerability in Adobe Experience Manager (AEM) 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog.
Published 10 Feb 2016 · NVD - High 7.6
CVE-2016-0603 · Java
Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted…
Published 8 Feb 2016 · NVD - Medium 5.9
CVE-2016-1284 · BIND 9
rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5, when nxdomain-redirect is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via crafted flag values in a query.
Published 4 Feb 2016 · NVD - High 7.5
CVE-2015-7539 · Jenkins
The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.
Published 3 Feb 2016 · NVD - High 8.8
CVE-2015-7538 · Jenkins
Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.
Published 3 Feb 2016 · NVD - High 8.8
CVE-2015-7537 · Jenkins
Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
Published 3 Feb 2016 · NVD - Medium 5.4
CVE-2015-7536 · Jenkins
Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
Published 3 Feb 2016 · NVD - Medium 6.5
CVE-2016-2213 · FFmpeg
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
Published 3 Feb 2016 · NVD - High 7.3
CVE-2016-0755 · curl
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
Published 29 Jan 2016 · NVD - Medium 5.3
CVE-2016-0754 · curl
cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.
Published 29 Jan 2016 · NVD - Medium 6.1
CVE-2015-8793 · Roundcube
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.
Published 29 Jan 2016 · NVD - Medium 5.9
CVE-2016-2047 · MariaDB, MySQL
The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
Published 27 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD - Medium 5.4
CVE-2015-7417 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider.
Published 23 Jan 2016 · NVD - Medium 6.3
CVE-2016-1571 · Xen
The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.
Published 22 Jan 2016 · NVD - High 8.5
CVE-2016-1570 · Xen
The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to…
Published 22 Jan 2016 · NVD - Medium 5.9
CVE-2015-7744 · MariaDB
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
Published 22 Jan 2016 · Fixed in 5.5.46, 10.0.22, 10.1.9 · NVD - Medium 4.0
CVE-2016-0616 · MariaDB, MySQL
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
Published 21 Jan 2016 · NVD - Medium 4.0
CVE-2016-0611 · MySQL
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
Published 21 Jan 2016 · NVD - Low 3.5
CVE-2016-0610 · MariaDB, MySQL
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
Published 21 Jan 2016 · NVD - Low 1.7
CVE-2016-0609 · MariaDB, MySQL
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges.
Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.