UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,019
Published in 7 days
1,112
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,019 vulnerabilities
  1. Low 3.5

    CVE-2015-4807 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  2. Medium 6.4

    CVE-2015-4806 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

    Published 21 Oct 2015 · NVD
  3. High 10.0

    CVE-2015-4805 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

    Published 21 Oct 2015 · NVD
  4. Medium 5.0

    CVE-2015-4803 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.

    Published 21 Oct 2015 · NVD
  5. Medium 4.0

    CVE-2015-4802 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  6. Medium 4.0

    CVE-2015-4800 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

    Published 21 Oct 2015 · NVD
  7. Low 1.7

    CVE-2015-4792 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  8. Low 3.5

    CVE-2015-4791 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 21 Oct 2015 · NVD
  9. Low 1.9

    CVE-2015-4766 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall.

    Published 21 Oct 2015 · NVD
  10. Medium 5.0

    CVE-2015-4734 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.

    Published 21 Oct 2015 · NVD
  11. Medium 4.0

    CVE-2015-4730 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.20 and earlier allows remote authenticated users to affect availability via unknown vectors related to Types.

    Published 21 Oct 2015 · NVD
  12. Low 2.1

    CVE-2015-5742 · Veeam Backup & Replication

    VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by reading the files.

    Published 16 Oct 2015 · NVD
  13. High 7.5

    CVE-2015-1814 · Jenkins

    The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.

    Published 16 Oct 2015 · NVD
  14. Medium 4.3

    CVE-2015-1813 · Jenkins

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.

    Published 16 Oct 2015 · NVD
  15. Medium 4.3

    CVE-2015-1812 · Jenkins

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.

    Published 16 Oct 2015 · NVD
  16. Medium 4.6

    CVE-2015-1810 · Jenkins

    The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

    Published 16 Oct 2015 · NVD
  17. Low 3.5

    CVE-2015-1808 · Jenkins

    Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.

    Published 16 Oct 2015 · NVD
  18. Low 3.5

    CVE-2015-1807 · Jenkins

    Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.

    Published 16 Oct 2015 · NVD
  19. Medium 6.5

    CVE-2015-1806 · Jenkins

    The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.

    Published 16 Oct 2015 · NVD
  20. High 9.3

    CVE-2015-7361 · Fortinet FortiOS

    FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors.

    Published 15 Oct 2015 · NVD
  21. Medium 6.8

    CVE-2015-6761 · FFmpeg

    The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.

    Published 15 Oct 2015 · NVD
  22. Unrated

    WPV-7c991982251b · Akismet (WordPress plugin)

    Vulnerability in Akismet Anti-spam: Spam Protection

    Published 13 Oct 2015 · Fixed in 3.1.5 · WPVulnerability
  23. Medium 6.1

    CVE-2015-9357 · Akismet (WordPress plugin)

    Akismet Anti-spam: Spam Protection: Cross-site Scripting

    Published 13 Oct 2015 · Fixed in 3.1.5 · WPVulnerability
  24. High 10.0

    CVE-2015-2342 · VMware vCenter Server

    The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.

    Published 12 Oct 2015 · NVD
  25. Medium 5.0

    CVE-2015-1047 · VMware vCenter Server

    vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.

    Published 12 Oct 2015 · NVD
  26. Medium 6.8

    CVE-2015-6607 · SQLite

    SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.

    Published 6 Oct 2015 · NVD
  27. High 7.2

    CVE-2015-5652 · Python

    Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."

    Published 6 Oct 2015 · NVD
  28. Medium 4.0

    CVE-2015-7685 · GLPI

    GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter to front/user.form.php.

    Published 5 Oct 2015 · NVD
  29. High 9.0

    CVE-2015-7684 · GLPI

    Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.

    Published 5 Oct 2015 · NVD
  30. Low 3.6

    CVE-2015-7311 · Xen

    libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.

    Published 1 Oct 2015 · NVD
  31. Unrated

    WPV-d6643ccca9c5 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.2 · WPVulnerability
  32. Unrated

    WPV-861c42a54d27 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.1 · WPVulnerability
  33. Unrated

    WPV-46617b404f70 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.2 · WPVulnerability
  34. Unrated

    WPV-185052db41ab · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 1 Oct 2015 · Fixed in 3.7.1 · WPVulnerability
  35. Medium 4.3

    CVE-2015-7604 · Splunk Enterprise

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.6 and Splunk Light 6.2.x before 6.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 29 Sept 2015 · NVD
  36. Medium 6.8

    CVE-2015-5400 · Squid

    Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.

    Published 28 Sept 2015 · NVD
  37. Medium 6.8

    CVE-2015-1781 · GNU C Library

    Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.

    Published 28 Sept 2015 · NVD
  38. Unrated

    WPV-b28039f3e2cf · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 26 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  39. Unrated

    WPV-22a8df67b13a · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 26 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  40. Unrated

    WPV-822eb8c8780d · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  41. Unrated

    WPV-64658a4f2f13 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  42. Unrated

    WPV-191aaebdae4e · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  43. Medium 5.8

    CVE-2015-6932 · VMware vCenter Server

    VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

    Published 18 Sept 2015 · NVD
  44. Medium 4.3

    CVE-2015-6939 · Joomla!

    Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 18 Sept 2015 · NVD
  45. Medium 5.0

    CVE-2015-4638 · F5 BIG-IP

    The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through 11.5.2 and 11.6.0 through 11.6.0 HF4, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.1 through 11.3.0, and BIG-IP PSM 11.2.1 through 11.4.1 allows remote attackers to cause a denial of service (Traffic Management Microkernel restart) via a fragmented packet.

    Published 18 Sept 2015 · NVD
  46. High 10.0

    CVE-2015-5895 · SQLite

    Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.

    Published 18 Sept 2015 · NVD
  47. Medium 4.0

    CVE-2015-4040 · F5 BIG-IP

    Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors.

    Published 17 Sept 2015 · NVD
  48. Low 3.5

    CVE-2015-5956 · TYPO3

    The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.

    Published 16 Sept 2015 · NVD
  49. Medium 5.0

    CVE-2015-6830 · phpMyAdmin

    libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

    Published 14 Sept 2015 · NVD
  50. Medium 4.3

    CVE-2015-2544 · Microsoft Exchange Server

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

    Published 9 Sept 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.