UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,019
Published in 7 days
1,112
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,019 vulnerabilities
  1. Medium 5.0

    CVE-2015-2621 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX.

    Published 16 Jul 2015 · NVD
  2. Medium 4.3

    CVE-2015-2620 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.

    Published 16 Jul 2015 · Fixed in 5.5.44, 10.0.20 · NVD
  3. Medium 5.0

    CVE-2015-2619 · Java

    Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D.

    Published 16 Jul 2015 · NVD
  4. Medium 6.5

    CVE-2015-2617 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Partition.

    Published 16 Jul 2015 · NVD
  5. Medium 5.0

    CVE-2015-2613 · Java

    Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

    Published 16 Jul 2015 · NVD
  6. Medium 4.0

    CVE-2015-2611 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 16 Jul 2015 · NVD
  7. Medium 5.0

    CVE-2015-2601 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.

    Published 16 Jul 2015 · NVD
  8. High 7.2

    CVE-2015-2597 · Java

    Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install.

    Published 16 Jul 2015 · NVD
  9. Medium 4.3

    CVE-2015-2596 · Java

    Unspecified vulnerability in Oracle Java SE 7u80 allows remote attackers to affect integrity via unknown vectors related to Hotspot.

    Published 16 Jul 2015 · NVD
  10. Critical 9.8Actively exploited

    CVE-2015-2590 · Java

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

    Published 16 Jul 2015 · NVD
  11. Medium 4.0

    CVE-2015-2582 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

    Published 16 Jul 2015 · Fixed in 5.5.44, 10.0.20 · NVD
  12. Medium 4.4

    CVE-2015-1946 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server (WAS) 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors.

    Published 14 Jul 2015 · NVD
  13. Medium 6.0

    CVE-2015-1936 · IBM WebSphere Application Server

    The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter.

    Published 14 Jul 2015 · NVD
  14. Medium 6.8

    CVE-2015-1927 · IBM WebSphere Application Server

    The default configuration of IBM WebSphere Application Server (WAS) 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged access via unspecified vectors.

    Published 14 Jul 2015 · NVD
  15. Medium 6.8

    CVE-2015-5397 · Joomla!

    Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload code via unknown vectors.

    Published 14 Jul 2015 · NVD
  16. Medium 6.5

    CVE-2015-1793 · OpenSSL

    The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

    Published 9 Jul 2015 · NVD
  17. High 7.5

    CVE-2015-5380 · Node.js

    The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte…

    Published 9 Jul 2015 · NVD
  18. High 7.8

    CVE-2015-4620 · BIND 9

    name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

    Published 8 Jul 2015 · NVD
  19. Medium 6.1

    CVE-2015-4241 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliance (ASA) Software 9.3(2) allows remote attackers to cause a denial of service (system reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCut52679.

    Published 8 Jul 2015 · NVD
  20. Medium 4.3

    CVE-2015-3216 · OpenSSL

    Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establishing many TLS sessions to a multithreaded server, leading to use of a negative value for a…

    Published 7 Jul 2015 · NVD
  21. Medium 5.0

    CVE-2015-3281 · HAProxy

    The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.

    Published 6 Jul 2015 · NVD
  22. Medium 6.1

    CVE-2015-4239 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

    Published 3 Jul 2015 · NVD
  23. High 7.5

    CVE-2015-3717 · SQLite

    Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

    Published 3 Jul 2015 · Fixed in 3.8.9 · NVD
  24. Medium 6.8

    CVE-2015-4238 · Cisco ASA and Firepower Threat Defense

    The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601.

    Published 2 Jul 2015 · NVD
  25. Medium 5.0

    CVE-2014-9734 · Slider Revolution

    Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.

    Published 30 Jun 2015 · NVD
  26. Medium 6.5

    CVE-2015-5078 · LimeSurvey

    SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.

    Published 28 Jun 2015 · NVD
  27. Medium 4.3

    CVE-2015-5063 · Silverstripe CMS

    Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter to install.php.

    Published 24 Jun 2015 · NVD
  28. Medium 5.8

    CVE-2015-5062 · Silverstripe CMS

    Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build.

    Published 24 Jun 2015 · NVD
  29. Medium 5.0

    CVE-2015-3900 · Ruby

    RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

    Published 24 Jun 2015 · NVD
  30. Unrated

    WPV-e769011f073f · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 24 Jun 2015 · Fixed in 5.2.4 · WPVulnerability
  31. Medium 6.4

    CVE-2015-3237 · curl

    The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.

    Published 22 Jun 2015 · NVD
  32. Medium 5.0

    CVE-2015-3236 · curl

    cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

    Published 22 Jun 2015 · NVD
  33. Medium 4.3

    CVE-2015-3234 · Drupal

    The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

    Published 22 Jun 2015 · NVD
  34. Medium 5.8

    CVE-2015-3233 · Drupal

    Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

    Published 22 Jun 2015 · NVD
  35. Medium 5.8

    CVE-2015-3232 · Drupal

    Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.

    Published 22 Jun 2015 · NVD
  36. Medium 4.0

    CVE-2015-3231 · Drupal

    The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache.

    Published 22 Jun 2015 · NVD
  37. High 7.5

    CVE-2015-4654 · Joomla!

    SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.

    Published 18 Jun 2015 · NVD
  38. Medium 6.5

    CVE-2015-4628 · LimeSurvey

    SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.

    Published 18 Jun 2015 · NVD
  39. Medium 4.3

    CVE-2015-4550 · Cisco ASA and Firepower Threat Defense

    The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.

    Published 17 Jun 2015 · NVD
  40. Unrated

    WPV-e39e6c16af67 · WooCommerce

    Vulnerability in WooCommerce

    Published 17 Jun 2015 · Fixed in 2.3.11 · WPVulnerability
  41. Medium 6.8

    CVE-2015-3395 · FFmpeg

    The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.

    Published 16 Jun 2015 · NVD
  42. Medium 4.9

    CVE-2015-4164 · Xen

    The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.

    Published 15 Jun 2015 · NVD
  43. Medium 4.9

    CVE-2015-4163 · Xen

    GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.

    Published 15 Jun 2015 · NVD
  44. Medium 6.8

    CVE-2015-4119 · ISPConfig

    Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.

    Published 15 Jun 2015 · NVD
  45. Medium 6.5

    CVE-2015-4118 · ISPConfig

    SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.

    Published 15 Jun 2015 · NVD
  46. Medium 4.3

    CVE-2015-4093 · Kibana

    Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 15 Jun 2015 · NVD
  47. Medium 5.0

    CVE-2015-1792 · OpenSSL

    The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.

    Published 12 Jun 2015 · NVD
  48. Medium 6.8

    CVE-2015-1791 · OpenSSL

    Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse…

    Published 12 Jun 2015 · NVD
  49. Medium 5.0

    CVE-2015-1790 · OpenSSL

    The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.

    Published 12 Jun 2015 · NVD
  50. High 7.5

    CVE-2015-1789 · OpenSSL

    The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification…

    Published 12 Jun 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.