UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,019
Published in 7 days
1,112
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,019 vulnerabilities
  1. Medium 5.0

    CVE-2013-7443 · SQLite

    Buffer overflow in the skip-scan optimization in SQLite 3.8.2 allows remote attackers to cause a denial of service (crash) via crafted SQL statements.

    Published 12 Aug 2015 · NVD
  2. Medium 5.0

    CVE-2015-5965 · Fortinet FortiOS

    The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier for remote attackers to spoof encrypted content via a crafted MAC field.

    Published 11 Aug 2015 · NVD
  3. Medium 4.3

    CVE-2015-3626 · Fortinet FortiOS

    Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname.

    Published 11 Aug 2015 · NVD
  4. Medium 6.4

    CVE-2015-2323 · Fortinet FortiOS

    FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets.

    Published 11 Aug 2015 · NVD
  5. Medium 4.3

    CVE-2015-3439 · WordPress

    Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

    Published 5 Aug 2015 · NVD
  6. Medium 4.3

    CVE-2015-3438 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.

    Published 5 Aug 2015 · NVD
  7. Medium 4.0

    CVE-2015-5623 · WordPress

    WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.

    Published 3 Aug 2015 · NVD
  8. Low 3.5

    CVE-2015-5622 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

    Published 3 Aug 2015 · NVD
  9. Medium 4.3

    CVE-2015-3440 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.

    Published 3 Aug 2015 · NVD
  10. High 8.1

    CVE-2015-5600 · OpenSSH

    The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a…

    Published 3 Aug 2015 · NVD
  11. Medium 4.3

    CVE-2015-5352 · OpenSSH

    The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.

    Published 3 Aug 2015 · NVD
  12. High 7.5Actively exploited

    CVE-2015-5477 · BIND 9

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

    Published 29 Jul 2015 · Fixed in 9.9.7, 9.10.2 · NVD
  13. Medium 6.8

    CVE-2015-1872 · FFmpeg

    The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.

    Published 26 Jul 2015 · NVD
  14. Medium 6.8

    CVE-2015-1283 · Expat, Python

    Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.

    Published 23 Jul 2015 · Fixed in 3.3.7, 3.4.5, 3.5.2 · NVD
  15. Medium 4.3

    CVE-2015-3185 · Apache HTTP Server

    The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API…

    Published 20 Jul 2015 · NVD
  16. Medium 5.0

    CVE-2015-3183 · Apache HTTP Server

    The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

    Published 20 Jul 2015 · Fixed in 2.2.31, 2.4.16 · NVD
  17. Medium 5.0

    CVE-2015-0253 · Apache HTTP Server

    The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.

    Published 20 Jul 2015 · NVD
  18. Medium 4.3

    CVE-2015-4458 · Cisco ASA and Firepower Threat Defense

    The TLS implementation in the Cavium cryptographic-module firmware, as distributed with Cisco Adaptive Security Appliance (ASA) Software 9.1(5.21) and other products, does not verify the MAC field, which allows man-in-the-middle attackers to spoof TLS content by modifying packets, aka Bug ID CSCuu52976.

    Published 18 Jul 2015 · NVD
  19. Medium 6.8

    CVE-2015-3259 · Xen

    Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument.

    Published 16 Jul 2015 · NVD
  20. High 7.5

    CVE-2015-1831 · Apache Struts

    The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.

    Published 16 Jul 2015 · NVD
  21. Medium 4.0

    CVE-2015-4772 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.

    Published 16 Jul 2015 · NVD
  22. Low 3.5

    CVE-2015-4771 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to RBR.

    Published 16 Jul 2015 · NVD
  23. Low 3.5

    CVE-2015-4769 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4767.

    Published 16 Jul 2015 · NVD
  24. Low 1.7

    CVE-2015-4767 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Firewall, a different vulnerability than CVE-2015-4769.

    Published 16 Jul 2015 · NVD
  25. Low 3.5

    CVE-2015-4761 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

    Published 16 Jul 2015 · NVD
  26. High 10.0

    CVE-2015-4760 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 16 Jul 2015 · NVD
  27. Low 3.5

    CVE-2015-4757 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

    Published 16 Jul 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  28. Medium 4.0

    CVE-2015-4756 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0439.

    Published 16 Jul 2015 · NVD
  29. Medium 4.0

    CVE-2015-4752 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S.

    Published 16 Jul 2015 · Fixed in 5.5.44, 10.0.20 · NVD
  30. Medium 4.3

    CVE-2015-4749 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.

    Published 16 Jul 2015 · NVD
  31. High 7.6

    CVE-2015-4748 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.

    Published 16 Jul 2015 · NVD
  32. Low 3.5

    CVE-2015-4737 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth.

    Published 16 Jul 2015 · NVD
  33. High 9.3

    CVE-2015-4736 · Java

    Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 16 Jul 2015 · NVD
  34. High 10.0

    CVE-2015-4733 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.

    Published 16 Jul 2015 · NVD
  35. High 10.0

    CVE-2015-4732 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590.

    Published 16 Jul 2015 · NVD
  36. High 10.0

    CVE-2015-4731 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

    Published 16 Jul 2015 · NVD
  37. Medium 4.0

    CVE-2015-4729 · Java

    Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment.

    Published 16 Jul 2015 · NVD
  38. Medium 6.9

    CVE-2015-2664 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 16 Jul 2015 · NVD
  39. Low 2.1

    CVE-2015-2661 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows local users to affect availability via unknown vectors related to Client.

    Published 16 Jul 2015 · NVD
  40. Medium 5.0

    CVE-2015-2659 · Java

    Unspecified vulnerability in Oracle Java SE 8u45 and Java SE Embedded 8u33 allows remote attackers to affect availability via unknown vectors related to Security.

    Published 16 Jul 2015 · NVD
  41. Medium 4.0

    CVE-2015-2648 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 16 Jul 2015 · Fixed in 5.5.44, 10.0.20 · NVD
  42. Medium 4.0

    CVE-2015-2643 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

    Published 16 Jul 2015 · Fixed in 5.5.44, 10.0.20 · NVD
  43. Low 3.5

    CVE-2015-2641 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 16 Jul 2015 · NVD
  44. Low 3.5

    CVE-2015-2639 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Firewall.

    Published 16 Jul 2015 · NVD
  45. High 10.0

    CVE-2015-2638 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 16 Jul 2015 · NVD
  46. Medium 5.0

    CVE-2015-2637 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

    Published 16 Jul 2015 · NVD
  47. Medium 5.0

    CVE-2015-2632 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

    Published 16 Jul 2015 · NVD
  48. High 10.0

    CVE-2015-2628 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.

    Published 16 Jul 2015 · NVD
  49. Low 2.6

    CVE-2015-2627 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.

    Published 16 Jul 2015 · NVD
  50. Low 2.6

    CVE-2015-2625 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.

    Published 16 Jul 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.