UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,018
Published in 7 days
1,111
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,018 vulnerabilities
  1. Medium 5.3

    CVE-2016-0754 · curl

    cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

    Published 29 Jan 2016 · NVD
  2. Medium 6.1

    CVE-2015-8793 · Roundcube

    Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.

    Published 29 Jan 2016 · NVD
  3. Medium 5.9

    CVE-2016-2047 · MariaDB, MySQL

    The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…

    Published 27 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  4. Medium 5.4

    CVE-2015-7417 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider.

    Published 23 Jan 2016 · NVD
  5. Medium 6.3

    CVE-2016-1571 · Xen

    The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.

    Published 22 Jan 2016 · NVD
  6. High 8.5

    CVE-2016-1570 · Xen

    The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to…

    Published 22 Jan 2016 · NVD
  7. Medium 5.9

    CVE-2015-7744 · MariaDB

    wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.

    Published 22 Jan 2016 · Fixed in 5.5.46, 10.0.22, 10.1.9 · NVD
  8. Medium 4.0

    CVE-2016-0616 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · NVD
  9. Medium 4.0

    CVE-2016-0611 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · NVD
  10. Low 3.5

    CVE-2016-0610 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 21 Jan 2016 · NVD
  11. Low 1.7

    CVE-2016-0609 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  12. Low 3.5

    CVE-2016-0608 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  13. Low 2.8

    CVE-2016-0607 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication.

    Published 21 Jan 2016 · NVD
  14. Low 3.5

    CVE-2016-0606 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  15. Low 2.1

    CVE-2016-0605 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors.

    Published 21 Jan 2016 · NVD
  16. Low 3.5

    CVE-2016-0601 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition.

    Published 21 Jan 2016 · NVD
  17. Low 3.5

    CVE-2016-0600 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  18. Low 3.5

    CVE-2016-0599 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · NVD
  19. Low 3.5

    CVE-2016-0598 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  20. Medium 4.0

    CVE-2016-0597 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  21. Medium 4.0

    CVE-2016-0596 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  22. Medium 4.0

    CVE-2016-0595 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · NVD
  23. Medium 4.3

    CVE-2016-0594 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Jan 2016 · NVD
  24. High 7.5

    CVE-2016-0577 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-0574.

    Published 21 Jan 2016 · NVD
  25. High 7.5

    CVE-2016-0574 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-0577.

    Published 21 Jan 2016 · NVD
  26. High 7.5

    CVE-2016-0573 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.

    Published 21 Jan 2016 · NVD
  27. High 7.5

    CVE-2016-0572 · Oracle WebLogic Server

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.

    Published 21 Jan 2016 · NVD
  28. High 7.2

    CVE-2016-0546 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that…

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  29. Medium 6.8

    CVE-2016-0505 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options.

    Published 21 Jan 2016 · Fixed in 5.5.47, 10.0.23, 10.1.10 · NVD
  30. Medium 6.8

    CVE-2016-0504 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503.

    Published 21 Jan 2016 · NVD
  31. Medium 4.0

    CVE-2016-0503 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504.

    Published 21 Jan 2016 · NVD
  32. Medium 6.5

    CVE-2016-0502 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2016 · Fixed in 5.5.32, 10.0.4 · NVD
  33. High 10.0

    CVE-2016-0494 · Java

    Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 21 Jan 2016 · NVD
  34. High 10.0

    CVE-2016-0483 · Java

    Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function,…

    Published 21 Jan 2016 · NVD
  35. Medium 5.8

    CVE-2016-0475 · Java

    Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

    Published 21 Jan 2016 · NVD
  36. Medium 5.0

    CVE-2016-0466 · Java

    Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.

    Published 21 Jan 2016 · NVD
  37. Medium 4.0

    CVE-2016-0448 · Java

    Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.

    Published 21 Jan 2016 · NVD
  38. Medium 5.0

    CVE-2016-0402 · Java

    Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.

    Published 21 Jan 2016 · NVD
  39. High 7.5

    CVE-2015-5516 · F5 BIG-IP

    Memory leak in the last hop kernel module in F5 BIG-IP LTM, GTM, and Link Controller 10.1.x, 10.2.x before 10.2.4 HF13, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x, 11.5.x before 11.5.3 HF2, and 11.6.x before HF6, BIG-IP AAM 11.4.x, 11.5.x before 11.5.3 HF2 and 11.6.0 before HF6, BIG-IP AFM and PEM 11.3.x, 11.4.x, 11.5.x before 11.5.3 HF2, and 11.6.0 before HF6, BIG-IP Analytics 11.x before 11.2.1…

    Published 20 Jan 2016 · NVD
  40. High 7.0

    CVE-2015-8705 · BIND 9

    buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.

    Published 20 Jan 2016 · NVD
  41. Medium 6.5

    CVE-2015-8704 · BIND 9

    apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.

    Published 20 Jan 2016 · NVD
  42. Medium 5.5

    CVE-2015-8777 · GNU C Library

    The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.

    Published 20 Jan 2016 · NVD
  43. Medium 5.3

    CVE-2016-1907 · OpenSSH

    The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.

    Published 19 Jan 2016 · NVD
  44. High 7.3

    CVE-2016-1904 · PHP

    Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the (1) php_escape_shell_cmd or (2) php_escape_shell_arg function, leading to a heap-based buffer overflow.

    Published 19 Jan 2016 · NVD
  45. Critical 9.1

    CVE-2016-1903 · PHP

    The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function.

    Published 19 Jan 2016 · NVD
  46. Critical 9.8

    CVE-2015-8617 · PHP

    Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.

    Published 19 Jan 2016 · NVD
  47. High 8.6

    CVE-2015-8616 · PHP

    Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.

    Published 19 Jan 2016 · NVD
  48. High 7.3

    CVE-2015-6836 · PHP

    The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code via crafted serialized data that triggers a "type confusion" in the serialize_function_call function.

    Published 19 Jan 2016 · NVD
  49. High 7.5

    CVE-2015-6833 · PHP

    Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.

    Published 19 Jan 2016 · NVD
  50. High 7.3

    CVE-2015-6832 · PHP

    Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field.

    Published 19 Jan 2016 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.