UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,021
Published in 7 days
1,114
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,021 vulnerabilities
  1. Medium 6.5

    CVE-2015-1399 · Magento / Adobe Commerce

    PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since…

    Published 29 Apr 2015 · NVD
  2. Medium 6.5

    CVE-2015-1398 · Magento / Adobe Commerce

    Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the…

    Published 29 Apr 2015 · NVD
  3. Medium 6.5

    CVE-2015-1397 · Magento / Adobe Commerce

    SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.

    Published 29 Apr 2015 · NVD
  4. Medium 4.3

    CVE-2015-3447 · SonicWall SonicOS

    Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter.

    Published 29 Apr 2015 · NVD
  5. Low 2.9

    CVE-2015-3340 · Xen

    Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

    Published 28 Apr 2015 · NVD
  6. High 9.3

    CVE-2015-1885 · IBM WebSphere Application Server

    WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.

    Published 27 Apr 2015 · NVD
  7. High 8.5

    CVE-2015-1882 · IBM WebSphere Application Server

    Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.

    Published 27 Apr 2015 · NVD
  8. Medium 5.5

    CVE-2015-0175 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

    Published 27 Apr 2015 · NVD
  9. Medium 4.0

    CVE-2015-0174 · IBM WebSphere Application Server

    The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

    Published 27 Apr 2015 · NVD
  10. Medium 6.8

    CVE-2015-3417 · FFmpeg

    Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.

    Published 24 Apr 2015 · NVD
  11. High 7.5

    CVE-2015-3416 · PHP, SQLite

    The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

    Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD
  12. High 7.5

    CVE-2015-3415 · PHP, SQLite

    The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

    Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD
  13. High 7.5

    CVE-2015-3414 · PHP, SQLite

    SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

    Published 24 Apr 2015 · Fixed in 5.4.42, 5.5.26, 5.6.10 · NVD
  14. Medium 5.0

    CVE-2015-3148 · curl

    cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.

    Published 24 Apr 2015 · NVD
  15. High 7.5

    CVE-2015-3145 · curl

    The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

    Published 24 Apr 2015 · NVD
  16. High 9.0

    CVE-2015-3144 · curl

    The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

    Published 24 Apr 2015 · NVD
  17. Medium 5.0

    CVE-2015-3143 · curl

    cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.

    Published 24 Apr 2015 · NVD
  18. Unrated

    WPV-f967e51cbb1c · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 20 Apr 2015 · Fixed in 2.2.6.2 · WPVulnerability
  19. Unrated

    WPV-e79447e47a65 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
  20. Unrated

    WPV-98fe49343dfe · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 20 Apr 2015 · Fixed in 1.9.6.4 · WPVulnerability
  21. Unrated

    WPV-92afc7a45f4d · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 20 Apr 2015 · Fixed in 1.9.6.4 · WPVulnerability
  22. Unrated

    WPV-64ab3d07f7dd · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 20 Apr 2015 · Fixed in 3.4.3 · WPVulnerability
  23. Unrated

    WPV-2f093ee917a5 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
  24. Medium 6.1

    CVE-2015-9359 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 20 Apr 2015 · Fixed in 3.4.3 · NVD, WPVulnerability
  25. Low 2.1

    CVE-2015-2576 · MySQL

    Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.

    Published 16 Apr 2015 · NVD
  26. Medium 4.0

    CVE-2015-2573 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  27. Medium 4.0

    CVE-2015-2571 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  28. Medium 5.0

    CVE-2015-2568 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 16 Apr 2015 · Fixed in 5.5.42, 10.0.17 · NVD
  29. Low 3.5

    CVE-2015-2567 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

    Published 16 Apr 2015 · NVD
  30. Low 2.8

    CVE-2015-2566 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 16 Apr 2015 · NVD
  31. Low 2.8

    CVE-2015-0511 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP.

    Published 16 Apr 2015 · NVD
  32. Medium 4.0

    CVE-2015-0508 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.

    Published 16 Apr 2015 · NVD
  33. Low 3.5

    CVE-2015-0507 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

    Published 16 Apr 2015 · NVD
  34. Low 3.5

    CVE-2015-0506 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2015-0508.

    Published 16 Apr 2015 · NVD
  35. Low 3.5

    CVE-2015-0505 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  36. Medium 4.0

    CVE-2015-0503 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.

    Published 16 Apr 2015 · NVD
  37. Medium 5.7

    CVE-2015-0501 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  38. Medium 4.0

    CVE-2015-0500 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors.

    Published 16 Apr 2015 · NVD
  39. Low 3.5

    CVE-2015-0499 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated.

    Published 16 Apr 2015 · Fixed in 5.5.43, 10.0.18 · NVD
  40. Low 1.7

    CVE-2015-0498 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.

    Published 16 Apr 2015 · NVD
  41. High 9.3

    CVE-2015-0492 · Java

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.

    Published 16 Apr 2015 · NVD
  42. High 10.0

    CVE-2015-0491 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459.

    Published 16 Apr 2015 · NVD
  43. Medium 5.0

    CVE-2015-0488 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.

    Published 16 Apr 2015 · NVD
  44. Medium 5.0

    CVE-2015-0486 · Java

    Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

    Published 16 Apr 2015 · NVD
  45. Medium 6.8

    CVE-2015-0484 · Java

    Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0492.

    Published 16 Apr 2015 · NVD
  46. Medium 5.8

    CVE-2015-0480 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.

    Published 16 Apr 2015 · NVD
  47. Medium 4.3

    CVE-2015-0478 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE.

    Published 16 Apr 2015 · NVD
  48. Medium 4.3

    CVE-2015-0477 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans.

    Published 16 Apr 2015 · NVD
  49. Medium 4.3

    CVE-2015-0470 · Java

    Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot.

    Published 16 Apr 2015 · NVD
  50. High 10.0

    CVE-2015-0469 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 16 Apr 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.