Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 40,021
- Published in 7 days
- 1,114
- Critical in 30 days
- 386
- Actively exploited
- 423
Latest vulnerabilities
40,021 vulnerabilities- Medium 4.0
CVE-2015-0214 · Moodle
message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request.
Published 1 Jun 2015 · NVD - Medium 6.8
CVE-2015-0213 · Moodle
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.
Published 1 Jun 2015 · NVD - Low 3.5
CVE-2015-0212 · Moodle
Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary.
Published 1 Jun 2015 · NVD - Medium 4.0
CVE-2015-0211 · Moodle
mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service.
Published 1 Jun 2015 · NVD - High 7.8
CVE-2015-4047 · F5 BIG-IP
racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Published 29 May 2015 · NVD - Medium 4.3
CVE-2015-3165 · PostgreSQL
Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
Published 28 May 2015 · NVD - Medium 4.3
CVE-2015-3903 · phpMyAdmin
libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Published 26 May 2015 · NVD - Medium 6.8
CVE-2015-3902 · phpMyAdmin
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
Published 26 May 2015 · NVD - Medium 5.0
CVE-2015-0742 · Cisco ASA and Firepower Threat Defense
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registration, which allows remote attackers to cause a denial of service (forwarding outage) via a crafted…
Published 21 May 2015 · NVD - Low 3.7
CVE-2015-4000 · OpenSSL, Java
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Published 21 May 2015 · NVD - High 10.0
CVE-2015-1920 · IBM WebSphere Application Server
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session.
Published 20 May 2015 · NVD - Low 3.6
CVE-2015-3631 · Docker Engine
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Published 18 May 2015 · NVD - High 7.2
CVE-2015-3630 · Docker Engine
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Published 18 May 2015 · NVD - High 7.2
CVE-2015-3627 · Docker Engine
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Published 18 May 2015 · NVD - Low 2.6
CVE-2015-3455 · Squid
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.
Published 18 May 2015 · NVD - Critical 10.0Actively exploited
CVE-2015-3306 · ProFTPD
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Published 18 May 2015 · NVD - High 10.0
CVE-2015-0278 · Node.js
libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
Published 18 May 2015 · Fixed in 0.10.37 · NVD - Unrated
WPV-fed8e858bf29 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 15 May 2015 · Fixed in 2.3.4 · WPVulnerability - Unrated
WPV-fc8e1afbc29b · W3 Total Cache (WordPress plugin)
Vulnerability in W3 Total Cache
Published 15 May 2015 · Fixed in 0.9.4.1 · WPVulnerability - Unrated
WPV-e4f87b5e23e2 · Redirection (WordPress plugin)
Vulnerability in Redirection
Published 15 May 2015 · Fixed in 2.2.9 · WPVulnerability - Unrated
WPV-cf8ffe159f9a · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.5 · WPVulnerability - Unrated
WPV-bfba9e175276 · All in One SEO
Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Published 15 May 2015 · Fixed in 2.1.6 · WPVulnerability - Unrated
WPV-bb471c36f639 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.5 · WPVulnerability - Unrated
WPV-ba31b7c4ba78 · All in One SEO
Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Published 15 May 2015 · Fixed in 2.1.6 · WPVulnerability - Unrated
WPV-ba2b29b2a445 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.3 · WPVulnerability - Unrated
WPV-aa479f9eee49 · WP Super Cache (WordPress plugin)
Vulnerability in WP Super Cache
Published 15 May 2015 · Fixed in 1.3.1 · WPVulnerability - Unrated
WPV-9ec8d069904d · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 5.2.4 · WPVulnerability - Unrated
WPV-9b466df1ce34 · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.3.6 · WPVulnerability - Unrated
WPV-7e928e56b207 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.3 · WPVulnerability - Unrated
WPV-7b8fc9e88eae · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.0.13 · WPVulnerability - Unrated
WPV-509e0e77b8fe · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.7 · WPVulnerability - Unrated
WPV-3d6938b3fa19 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.8.3 · WPVulnerability - Unrated
WPV-361ffa3ca1a4 · Wordfence Security
Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security
Published 15 May 2015 · Fixed in 3.3.7 · WPVulnerability - Unrated
WPV-1db3331b4461 · WooCommerce
Vulnerability in WooCommerce
Published 15 May 2015 · Fixed in 2.0.18 · WPVulnerability - Unrated
WPV-0f62f5811d51 · WP Super Cache (WordPress plugin)
Vulnerability in WP Super Cache
Published 15 May 2015 · Fixed in 1.4.3 · WPVulnerability - High 7.7
CVE-2015-3456 · Xen
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Published 13 May 2015 · NVD - Medium 5.0
CVE-2015-2668 · ClamAV
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.
Published 12 May 2015 · NVD - Medium 5.0
CVE-2015-2222 · ClamAV
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.
Published 12 May 2015 · NVD - Medium 5.0
CVE-2015-2221 · ClamAV
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.
Published 12 May 2015 · NVD - Medium 5.0
CVE-2015-2170 · ClamAV
The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
Published 12 May 2015 · NVD - Medium 4.3
CVE-2015-1880 · Fortinet FortiOS
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 12 May 2015 · NVD - Medium 4.3
CVE-2014-9326 · F5 BIG-IP
The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller 11.5.0 through 11.6.0, ASM 10.0.0 through 11.6.0, and PEM 11.3.0 through 11.6.0 and the (2) Call Home feature in ASM 10.0.0 through 11.6.0 and PEM 11.3.0 through 11.6.0 does not properly validate server SSL certificates, which allows remote attackers to…
Published 12 May 2015 · NVD - Medium 4.3
CVE-2014-8619 · Fortinet FortiWeb
Cross-site scripting (XSS) vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 12 May 2015 · NVD - Medium 4.3
CVE-2014-8616 · Fortinet FortiOS
Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) user group or (2) vpn template menus.
Published 12 May 2015 · NVD - Unrated
WPV-806319933a60 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 6 May 2015 · Fixed in 3.5.3 · WPVulnerability - Unrated
WPV-608914b2227f · Twentyfifteen (WordPress theme)
Vulnerability in Twenty Fifteen
Published 6 May 2015 · WPVulnerability - Unrated
WPV-2eb29006bbbd · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 6 May 2015 · Fixed in 3.5.3 · WPVulnerability - Medium 5.0
CVE-2015-3153 · curl
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Published 1 May 2015 · NVD - Medium 6.5
CVE-2015-3458 · Magento / Adobe Commerce
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue…
Published 29 Apr 2015 · NVD - Medium 5.0
CVE-2015-3457 · Magento / Adobe Commerce
Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
Published 29 Apr 2015 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.